Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] [retort] kmMail, SSL, certs, halls, mentos (includes link)

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "David R. Matusiak" <dave AT matusiak.org>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: Re: [internetworkers] [retort] kmMail, SSL, certs, halls, mentos (includes link)
  • Date: Tue, 10 Jun 2003 19:36:46 -0400

center-to-bottom-posted, for your convenience... ;)

On Tue, Jun 10, 2003 at 05:19:26PM -0400, machett AT ibiblio.org wrote:

sorry for the repost, but I think this got lost over the weekend. I really could use the technical help on this one...

-Alan

mmmmmm..... crumbled-up cookie-things.....

On Fri, 6 Jun 2003 12:29:03 -0400, I said:

Being the clueless wonder that I am, I have yet another question for anyone who has the obvious answer that I haven't learned yet...

Scenario:
Jane has accounts on both the Black and the White servers.

Jane is one l33t haX0R!! GO, Jane!! GO!!

the White server is SSL enabled.

a difficult target! Good show, Young Lass!!

the Black server is not,

HA HA! an easy victory!! Adding more zombies to your evil realm, huh Jane?

and Jane's INBOX resides there.

D'oh!!

Jane wants to use kmMail securely.

but then rethinks and realizes that all web-based email is lame and she should just be hardcore and read all her mail on the mail server using mutt, pine, elm, mail, or potentially vi (over ssh, of course).

Jane cannot receive mail at the White server.

What has Jane done to upset the White server?

Jane has been told by tech support/sysadmin that a server certificate can be installed for her on the Black server.

A What-er What-tificate? this sounds like some shoddy sales job from some crooked tech support minions. Jane should be more suspicious of people with "impressive titles such as 'Junior Sysadmin'." Jane should Teardrop that Black server just to show them who's boss!

What is the best solution? (easiest and most secure, security having priority)

[*] With security as a guiding principle, Jane would surely decide to forgo all means of electronic or written communication in the future and immediately move into a reasonably-priced cave in Saudi Arabia (while getting utilities connected via a fake name).

Is it sufficient to install kmMail on the secure server and simply point kmMail to the mail account on the other server?

Yes. If Jane wants all her communications to and fro the Black server monitored by local and federal government officials, then this is what she would do.

Should kmMail be installed on the non-SSL server along with a server cert'?

Oh, Goodness NO!! this is exactly what those hucksters in Tech Support /WANT/ Jane to do!! She would never fall prey to their foolish whims.

Should kmMail be installed on the SSL server and a cert' be installed on the other one, then point kmMail that way?

Was that in English?

Or is there some other solution?

see [*] above.

On Tuesday, June 10, 2003, at 05:33 PM, Scott Russell wrote:

I've gotta ask, what is your definition of 'use securely'?

Yeah! Just exactly *what* is Jane talking about here??

For logging into accounts and retrieving email the account password should be
secured. With IMAP you can use CRAM-MD5 or DIGEST-MD5 passwords which will
prevent the password from being sent over the wire in clear text. If the
server doesn't support that then yes, SSL is the way to go.

This sounds reasonable. Jane should probably listen to this guy.

Now I wouldn't bother to count on SSL for securing anything other than the
password when it comes to email. The entire end to end path an email takes
as it moves from the sender, to smtp servers, and finally to your inbox is
not secured. The email is passed over the wire and can be read at any point.

Remember that, regardless of their origin and/or destination, all email traveling in America must first pass through < filteringyourmail.us.military.gov > before making it to
< justarchivingyourmail.homeland.security.gov > which ultimately sends it along to its final destination. Certain mail that might set off "Highly-Sensitive Governmentally-Programmed Email-Is-Mainly-Used-By-Terrorists Filters" may be passed through other US Safety Agencies (such as the CIA, FBI, NSA, ATF, and quite possibly the DMV -- those bastards!!).

So what if you need end to end security for the contents of email? The
solution here is PGP which can handle both encryption of the email contents
as well as "trust relationships" which enable you to know that the sender is
really the person who sent the email.

This is EXACTLY the avenue Jane wants to go down if she wants to suddenly set off EVERY SINGLE FLAG set for governmental email monitoring EVER WRITTEN. The US Government has already shown how they feel about encryption of ANY kind, while still displaying their unusual and unreasonable hatred of PGP and the wicked person who invented it (probably to aid terrorists!!).

[*Ed. note: Phil Zimmerman links to Al Queda yet to be proven.]

I know this all doesn't answer your question directly but the point is you
may not need that SSL cert depending on what you expect to accomplish.

Jane should listen to Scott. He has eaten many brains.

--
Scott
Do not trifle with me, I have eaten 104 brains.
--

Like, somewhere around 100 brains, or something.

Come and play at the InterNetWorkers Web site! http://www.ibiblio.org/internetworkers/
You are currently subscribed to InterNetWorkers mailing list
To unsubscribe visit http://lists.ibiblio.org/mailman/listinfo/internetworkers

Why do they keep appending this garbage to every message I receive?? This must be part of the filtering done by George Bush and his cronies. Jane would be pissed if she had to put up with this crap! ..hidden secret.. < http://www.homestarrunner.com/cheatvideo.html >





Archive powered by MHonArc 2.6.24.

Top of Page