Subject: Re: [pkix] purpose of LDAP in PKI

From: Peter Gutmann <[email-masked]>
Date: Mon, 25 Feb 2013 00:13:59 +0000

Michael StJohns <[email-masked]> writes:

>But does that model work if you've got multiple MTAs between sender and
>receiver?  Does your local MTA translate the GETSMIME into a store and
>forward request of some sort?

I think you're over-thinking this.  At the moment we have nothing at all.  In
addition, probably something like 99% of all email is protected through
STARTTLS, not S/MIME (or PGP, or anything else), simply because STARTTLS is
almost everywhere and S/MIME and PGP in comparison are almost nowhere (this is
based on a survey of incoming/outgoing email at a couple of sites I did with a
few other folks a few years back).  So we're already only solving about 1% (or
less) of the problem no matter what we do.  If GETSMIME solves, say, 90% of
the 1%, that leaves 0.1% unsolved, and for something like that you can address
it on a case-by-case basis.  You're not looking for a perfect, universal
solution, just a good-enough solution that solves a big chunk of the current
problem without being too much of a pain to deploy.

Peter.

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 25 Feb 2013 14:20:07 +0000

Perhaps the Microsoft TV commercials complaining that Google mines gmail for ad targeting (in a holier-than-thou plug for hotmail) will bring attention to the fact that STARTTLS does not protect email from server operators.

But if that causes enough angst among the Facebook generation to raise S/MIME from 1% to 2%, I'd be shocked.  We care about privacy, as long as it's someone else's problem to solve without causing us any inconvenience.

Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Gutmann
Sent: Sunday, February 24, 2013 7:14 PM
To: IETF PKIX
Subject: Re: [pkix] purpose of LDAP in PKI

>forward request of some sort?

I think you're over-thinking this.  At the moment we have nothing at all.  In addition, probably something like 99% of all email is protected through STARTTLS, not S/MIME (or PGP, or anything else), simply because STARTTLS is almost everywhere and S/MIME and PGP in comparison are almost nowhere (this is based on a survey of incoming/outgoing email at a couple of sites I did with a few other folks a few years back).  So we're already only solving about 1% (or
less) of the problem no matter what we do.  If GETSMIME solves, say, 90% of the 1%, that leaves 0.1% unsolved, and for something like that you can address it on a case-by-case basis.  You're not looking for a perfect, universal solution, just a good-enough solution that solves a big chunk of the current problem without being too much of a pain to deploy.

Peter.
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix