D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Re Malware being distributed using list emails

 

On Thu, Mar 17, 2022, at 11:51 AM, maceion@xxxxxxxxx wrote:
> On 17/03/2022 00:37, Simon Waters wrote:
>> On Wednesday, 16 March 2022 21:14:18 GMT Rock Storm wrote:
>>> On Wed, 2022-03-16 at 14:10 +0000, Simon Waters wrote:
>>>> Email generally isn't the answer, although with strong encryption it
>>>> could be although most implementations of email encryption are pretty
>>>> ropey (e.g. S/MIME or PGP).
>>>
>>> I always thought PGP was good enough. Could you please elaborate on
>>> this? I'd be happy to try any better alternatives.
>> 
>> The encryption is as far as I know fine if you accept the modern defaults (and
>> haven't hard coded weaker choices in the config file).
>>.........
>> It is of course possible all these issues are now fixed in every email client,
>> but I doubt it. Not least a lot of the integrations between PGP and mail
>> client were a bit kludgy, rather than being a first class feature of the email
>> client (I recall Apple's Mail app in particular, the PGP plugin at the time
>> was a 3rd party modules working around various limitation of the Mail app from
>> Apple, Enigmail wasn't much better).
>> 
>> 
>> 
>> 
>
> Since Enigmail has been dropped by Mozilla Thunderbird, in favour of 
> their own GPG incorporation, How does it rate in your view?
>
> I find it distinguishes between three cases easily by icon and note
> a)   message digitally signed
> b)  message digitally signed and encrypted
> c)  Message encrypted but not digitally signed
> and of course
> d) message not digitally signed , and not encrypted (in my case almost 
> always in pure text, as it is set to reject HTML emails or show only in 
> text)
>
> In the case of encrypted message inserted as attachment, I am using 
> different encryption method using MailVelope and attaching to an 
> unencrypted message, so it passes normal servers in third country 
> subject and text in message body is readable, as is sender, recipient 
> and subject; as in normal email correspondence to that recipient
> This appears to work.
>
> I rarely ever have case of 'part of message body encrypted', but can see 
> where I might copy encrypted output into main body of message, but 
> surely just simpler to encrypt whole body of message.
>
> Any comment on this.
>
> Use of TOR browser is not possible as it is always detected at other end 
> in transit from exit server. And local forces are knocking on my 
> recipient's door in minutes.
> TOR worries authorities so response is very heavy handed.

Eion, I'd be interested to know why you think TOR results in that sort of response.

BBC for example has publicly announced a TOR service they host - 
https://www.bbc.com/mediacentre/articles/2022/advice-on-accessing-bbc-news - surely 
if this was undesirable, or seen as a 'bad thing', such a trusted news source would 
not publish...?

-- 
Kind regards,
--
Dom Rodriguez (also known as shymega)

-- 
The Mailing List for the Devon & Cornwall LUG
https://mailman.dcglug.org.uk/listinfo/list
FAQ: https://www.dcglug.org.uk/faq/