Subject: Re: [Asrg] Re: 2. Uselessness of C/R

From: mathew <[email-masked]>
Date: Thu, 18 Mar 2004 23:49:29 -0500

On Jan 28, 2004, at 19:16, Yakov Shafranovich wrote:
> Any ideas on what is the percentage of users that do not have S/MIME? 
> If MSFT, Mozilla, etc. and the other MUAs cover a virtual majority of 
> the market, and would cover a majority of users affected by the 
> phishing attacks, why aren't the banks deploying it?

Speaking as someone who's actually gone to the trouble of getting 
S/MIME set up... I can think of at least two reasons:

1. It's a pain in the ass to set up. You need to go through an 
unpleasant
    bureaucratic procedure to get your certificate, and there are 
apparently
    half a dozen different file formats and obscure tools needed to 
convert
    between them.

2. It doesn't work. Just because client A and client B both claim to 
support
    S/MIME, doesn't appear to mean that client A and client B can 
exchange
    messages.

In particular, if I sent myself an S/MIME message from work using Lotus 
Notes, Apple Mail can't read it. However, mail from Apple Mail to Lotus 
Notes verifies OK. I'm trying to interest our QA department in further 
investigation... Point is, it's still a rather flaky technology.

mathew
-- 
<URL:http://www.pobox.com/~meta/>

---

From: Doug Royer <[email-masked]>
Date: Fri, 19 Mar 2004 12:10:09 -0700

mathew wrote:

> 1. It's a pain in the ass to set up. You need to go through an unpleasant

Bad documentation from your vendors have nothing to do with S/MIME.

>    S/MIME, doesn't appear to mean that client A and client B can exchange
>    messages. 

A popular vendor broke their implementation of S/MIME, that was fixed years
ago and a simple upgrade will fix that.

No matter what solutions are chosen  to combat spam, the vendor will have
to implement it correctly or things will not work.

S/MIME is not broken, the vendors may have broken implementations.

-- 

Doug Royer                     |   http://INET-Consulting.com
-------------------------------|-----------------------------
[email-masked]                 | Office: (208)520-4044
http://Royer.com/People/Doug   | Fax:    (866)594-8574
                               | Cell:   (208)520-4044

              We Do Standards - You Need Standards

---

From: mathew <[email-masked]>
Date: Sat, 20 Mar 2004 00:01:51 -0500

> ago and a simple upgrade will fix that.

Well, your message signature doesn't seem valid to my mail program.

> S/MIME is not broken, the vendors may have broken implementations.

Yeah, and SMTP isn't broken, the servers just have broken 
configurations.

mathew

---

From: Doug Royer <[email-masked]>
Date: Sat, 20 Mar 2004 11:48:40 -0700

> Well, your message signature doesn't seem valid to my mail program. 

Again, your vendor being busted  does not mean that S/MIME is busted.
It means you need to contact your vendor and get them to fix their product.

Do you really mean to imply that if your vendor of choice does not get it
right that the protocol is busted?

> Yeah, and SMTP isn't broken, the servers just have broken configurations. 

Some might be busted, others implemented SMTP correctly.
It sill is not relevant to whether SMTP or S/MIME is busted.

--

---

From: mathew <[email-masked]>
Date: Mon, 22 Mar 2004 19:50:23 -0500

> Again, your vendor being busted  does not mean that S/MIME is busted.

No, but it's a good indication that S/MIME isn't ready for prime time 
when the three different S/MIME packages available to me can't talk to 
each other.

mathew

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 22 Mar 2004 20:11:35 -0500

> when the three different S/MIME packages available to me can't talk to 

I believe that OpenGroup is also working on an interoperability 
certification program for S/MIME specifically for that reason.

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Doug Royer <[email-masked]>
Date: Mon, 22 Mar 2004 19:49:18 -0700

> when the three different S/MIME packages available to me can't talk to 

I can name 4 popular ones that can interoperate with each other. So it 
looks ready to me.

--

---

From: Doug Royer <[email-masked]>
Date: Wed, 24 Mar 2004 11:04:01 -0700

mathew wrote:

> On Mar 22, 2004, at 21:49, Doug Royer wrote:
>
>>> No, but it's a good indication that S/MIME isn't ready for prime 
>>> time when the three different S/MIME packages available to me can't 
>>> talk to each other.
>>
>>
>> I can name 4 popular ones that can interoperate with each other. So 
>> it looks ready to me.
>
>
> Go on then.
>
> Here are three that don't: Lotus Notes, Mozilla, and Apple Mail.

I have exchanged HUNDREDS of S/MIME messages with IBM/Lotus
developers in the last year that use Lotus notes- so perhaps you have a 
buggy version?
We always sign our email and often encrypt it. I know it works with at least
newer versions of Lotus Notes.

I have never used Apple mail nor do I own an Apple system so I am unable 
to test
for issues with that implementation.

It works with (1) Outlook, (2) Exchange (which really are separate 
implementations)
(2) Lotus Notes , (3) Mozilla and Netscape Communicator (mostly the same
implementation) - that is what I use,  (4) Evolution , (5) TheBat,  and (6)
OpenSSL signature verification scanners. They also work with sendmails.org
milter filters interface for verifying S/MIME messages on the way in or out.

I own all of the above and have done testing of S/MIME with them.
I have tested both S/MIME digital signatures and encryption.

There are some older versions of Outlook that can not reply to an S/MIME
message, but can verify them. That is a bug in Outlook. Even older
versions of Outlook can not verify them. Both bugs are due to the
fact that someone at MS thought that you needed to have your own
cert in order to validate and reply to one. That was fixed a year
or two ago.

Older versions of Lotus Notes checked too many of the headers
and got validation errors. That was fixed about two years ago.

--

---

From: mathew <[email-masked]>
Date: Wed, 24 Mar 2004 12:20:46 -0500

On Mar 22, 2004, at 21:49, Doug Royer wrote:
>> when the three different S/MIME packages available to me can't talk 
>> to each other.
>

Go on then.

mathew

---

From: Jonathan Morton <[email-masked]>
Date: Wed, 24 Mar 2004 19:35:08 +0000

> developers in the last year that use Lotus notes- so perhaps you have 
> a buggy version?
> I have never used Apple mail nor do I own an Apple system so I am 
> unable to test

Just for the record, my copy of Apple Mail (on Panther) correctly 
verifies Doug's and Phillip's mails, but not mathew's.  It says that 
mathew's mails have been modified or tampered with.  Given that 
mathew's mail appears to have been *sent* from Apple Mail, I would 
suggest that his problem stems from somewhere in his own setup.

--------------------------------------------------------------
from:     Jonathan "Chromatix" Morton
mail:     [email-masked]
website:  http://www.chromatix.uklinux.net/
tagline:  The key to knowledge is not to rely on people to teach you it.

---

From: mathew <[email-masked]>
Date: Sat, 27 Mar 2004 23:32:47 -0500

> developers in the last year that use Lotus notes- so perhaps you have 

I've been trying to interest development in investigating the Mozilla, 
Notes and Apple Mail interoperability problems, but not having much 
luck. I'm running the latest gold code; I don't generally touch the 
beta stuff.

> and got validation errors. That was fixed about two years ago.

Well, I have problems with the latest gold code releases of all three 
programs.

> suggest that his problem stems from somewhere in his own setup.

Well, that's very strange. For me, Apple Mail, also running on Panther, 
doesn't verify Doug's or Phillip's mails--on either of two completely 
different machines. Maybe the e-mails really *have* been tampered with 
by some broken e-mail MTA somewhere?

I can send signed e-mail to myself at work and have Notes verify the 
signature correctly, so I have good reason to believe my mail is signed 
OK when I send it.

So again, it's pretty clear to me that this stuff just isn't reliable 
enough yet.

mathew

---

From: Doug Royer <[email-masked]>
Date: Sun, 28 Mar 2004 12:32:01 -0700

> luck. I'm running the latest gold code; I don't generally touch the 

I have sent this message to you directly AND to the list. It would be 
interesting
to see if one verifies and the other does not.

> Well, I have problems with the latest gold code releases of all three 

I have Bcc'd a friend at Lotus, perhaps he can send you a signed email. 
I helped
him fix their S/MIME problem a couple of years ago by sending him several
signed emails so he could test Notes when he noticed a problem  two 
years ago.

> Well, that's very strange. For me, Apple Mail, also running on 
> Panther, doesn't verify Doug's or Phillip's mails--on either of two 
> completely different machines. Maybe the e-mails really *have* been 
> tampered with by some broken e-mail MTA somewhere? 

That could be, this email also being sent to you directly may tell us.  
If you can, save
the entire email that fails to a file (headers and all) and send it to 
me as an attachment. I can
use a stand alone tool to look at it and its signature and compare them 
to what was sent.

> signature correctly, so I have good reason to believe my mail is 
> signed OK when I send it.
>

Or something is tampering and it is so reliable it is telling you that. 
Perhaps some
spam or anit-virus software is adding or changing something that breaks 
the signatures?
I have been using S/MIME signed email for years and this is the first
I have heard of any problem in years.

--