Serverside Sign and Crypt E-Mails

[Giovanni Baroni]

Hello Berhard

> This approach is possible (e.g. GEAM that Thomas mentioned), 
> but it has some inherit disadvantages:

Yep, i had tried this... but currently without luck (compiling error's)

> a) The signature are not as useful as before as your users will always claim
>     that the signing server could have made a mistake.
> b) The problem of selecting and trusting keys cannot be solved automatically
>     in all cases. In your above example, the question is: How does the server   
>     search for the public key. If it just looks on a public keyserver, the
>    attack simply is to uploaded a key with a faked user id.

Local Keyserver should be the way...
For now gpg importing keys manually is the goal. Maybe later a graphical
frontend.

> c) Regarding encryption, you never get better than a transport layer security
>     based on the MTA (e.g. TLS with postfix).

Yes, but this means just the way from the E-Mail Client to the Kolab Server.

Here in switzerland i dont know many (or at near nobody) who is using
encryption in E-Mails.
Im talking also from "Treuhänder", or "Anwälte" and others who should
care about privacy and security.

I began in 2000 with pgp and throwed this effort after a shortperiod
away ... just of no acceptance from other E-Mail partners... (and many
of them are also in the IT area)

6 Years later... the situation doesnt seems changed alot. OK maybe a
little better that the most people are now knowing that E-Mail is much
more insecure than a postmail.

E-Mail unsigned, unencrypted is the same like sending a Postcard to someone.

You have really good to search an E-Mail provider here that is using
POPS oder SMTPS. Also many E-Mail Server are included in a public shared
hosting environment who is never secure.

-------

Of course serverbased signing/encrypting isn't a very secure
scenario.... but much better than nothing.

I personally think.... if this sign/encrpytion/decryption process is
transparent to the user.... more people would use it.

It's not very userfriendly to use this tools on the client. Also it
depends on the client (outlook, thunderbird, webaccess....)
It's also a horrorscenario for administrating this for all clients :(

I think the acceptance of signing/encrypting and also of the Kolab
solution could gain by automating this.

Maybe every sendet E-Mail should be autom. signed.
If localKeyCache find the public key of the reciever it will autom.
encrypt the E-Mail

Maybe every incoming E-Mail will be stored autom. decrypted in the Imap
store.

Maybe all could be controlled in the Kolab ldap addressbook.

------

Currently im trying gpg4win with toltec and konsec Konnektor.
Toltec has problem to decrypt... no Problem to encrypt... but alot of
stability disadvanteges.

Konsec has problem to encrypt... no Problem to decrypt... run's stable
in combination with the GPGol Plugin.

Would be nice if all works find.... would be great if kolab has an
integrated transparent solution.

Giovanni