D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Re Malware being distributed using list emails

 

On 17/03/2022 00:37, Simon Waters wrote:
On Wednesday, 16 March 2022 21:14:18 GMT Rock Storm wrote:
On Wed, 2022-03-16 at 14:10 +0000, Simon Waters wrote:
Email generally isn't the answer, although with strong encryption it
could be although most implementations of email encryption are pretty
ropey (e.g. S/MIME or PGP).

I always thought PGP was good enough. Could you please elaborate on
this? I'd be happy to try any better alternatives.

The encryption is as far as I know fine if you accept the modern defaults (and
haven't hard coded weaker choices in the config file).
.........
It is of course possible all these issues are now fixed in every email client,
but I doubt it. Not least a lot of the integrations between PGP and mail
client were a bit kludgy, rather than being a first class feature of the email
client (I recall Apple's Mail app in particular, the PGP plugin at the time
was a 3rd party modules working around various limitation of the Mail app from
Apple, Enigmail wasn't much better).





Since Enigmail has been dropped by Mozilla Thunderbird, in favour of their own GPG incorporation, How does it rate in your view?

I find it distinguishes between three cases easily by icon and note
a)   message digitally signed
b)  message digitally signed and encrypted
c)  Message encrypted but not digitally signed
and of course
d) message not digitally signed , and not encrypted (in my case almost always in pure text, as it is set to reject HTML emails or show only in text)

In the case of encrypted message inserted as attachment, I am using different encryption method using MailVelope and attaching to an unencrypted message, so it passes normal servers in third country subject and text in message body is readable, as is sender, recipient and subject; as in normal email correspondence to that recipient
This appears to work.

I rarely ever have case of 'part of message body encrypted', but can see where I might copy encrypted output into main body of message, but surely just simpler to encrypt whole body of message.

Any comment on this.

Use of TOR browser is not possible as it is always detected at other end in transit from exit server. And local forces are knocking on my recipient's door in minutes.
TOR worries authorities so response is very heavy handed.


--
Regards
Eion MacDonald

--
The Mailing List for the Devon & Cornwall LUG
https://mailman.dcglug.org.uk/listinfo/list
FAQ: https://www.dcglug.org.uk/faq/