Internetworkers: http://www.ibiblio.org/internetworkers/

["David R. Matusiak" <dave AT matusiak.org>]

center-to-bottom-posted, for your convenience...  ;)

> On Tue, Jun 10, 2003 at 05:19:26PM -0400, machett AT ibiblio.org wrote:
> > sorry for the repost, but I think this got lost over the weekend.  I 
> > really could use the technical help on this one...
> >
> > -Alan

mmmmmm..... crumbled-up cookie-things.....

> > On Fri, 6 Jun 2003 12:29:03 -0400, I said:
> > > Being the clueless wonder that I am, I have yet another question for 
> > > anyone who has the obvious answer that I haven't learned yet...
> > >
> > > Scenario:
> > > Jane has accounts on both the Black and the White servers.

Jane is one l33t haX0R!!  GO, Jane!!  GO!!

> > > the White server is SSL enabled.

a difficult target!  Good show, Young Lass!!

> > > the Black server is not,

HA HA!  an easy victory!!  Adding more zombies to your evil realm, huh 
Jane?

> > > and Jane's INBOX resides there.

D'oh!!

> > > Jane wants to use kmMail securely.

but then rethinks and realizes that all web-based email is lame and she 
should just be hardcore and read all her mail on the mail server using 
mutt, pine, elm, mail, or potentially vi (over ssh, of course).

> > > Jane cannot receive mail at the White server.

What has Jane done to upset the White server?

> > > Jane has been told by tech support/sysadmin that a server 
> > > certificate can be installed for her on the Black server.

A What-er What-tificate?  this sounds like some shoddy sales job from 
some crooked tech support minions.  Jane should be more suspicious of 
people with "impressive titles such as 'Junior Sysadmin'."  Jane should 
Teardrop that Black server just to show them who's boss!

> > > What is the best solution? (easiest and most secure, security having 
> > > priority)

[*] With security as a guiding principle, Jane would surely decide to 
forgo all means of electronic or written communication in the future 
and immediately move into a reasonably-priced cave in Saudi Arabia 
(while getting utilities connected via a fake name).

> > > Is it sufficient to install kmMail on the secure server and simply 
> > > point kmMail to the mail account on the other server?

Yes.  If Jane wants all her communications to and fro the Black server 
monitored by local and federal government officials, then this is what 
she would do.

> > > Should kmMail be installed on the non-SSL server along with a server 
> > > cert'?

Oh, Goodness NO!! this is exactly what those hucksters in Tech Support 
/WANT/ Jane to do!!  She would never fall prey to their foolish whims.

> > > Should kmMail be installed on the SSL server and a cert' be 
> > > installed on the other one, then point kmMail that way?

Was that in English?

> > > Or is there some other solution?

see [*] above.

On Tuesday, June 10, 2003, at 05:33  PM, Scott Russell wrote:

> I've gotta ask, what is your definition of 'use securely'?

Yeah!  Just exactly *what* is Jane talking about here??

> For logging into accounts and retrieving email the account password 
> should be
> secured. With IMAP you can use CRAM-MD5 or DIGEST-MD5 passwords which 
> will
> prevent the password from being sent over the wire in clear text. If 
> the
> server doesn't support that then yes, SSL is the way to go.

This sounds reasonable.  Jane should probably listen to this guy.

> Now I wouldn't bother to count on SSL for securing anything other than 
> the
> password when it comes to email. The entire end to end path an email 
> takes
> as it moves from the sender, to smtp servers, and finally to your 
> inbox is
> not secured. The email is passed over the wire and can be read at any 
> point.

Remember that, regardless of their origin and/or destination, all email 
traveling in America must first pass through < 
filteringyourmail.us.military.gov > before making it to
< justarchivingyourmail.homeland.security.gov > which ultimately sends 
it along to its final destination.  Certain mail that might set off 
"Highly-Sensitive Governmentally-Programmed 
Email-Is-Mainly-Used-By-Terrorists Filters" may be passed through other 
US Safety Agencies (such as the CIA, FBI, NSA, ATF, and quite possibly 
the DMV -- those bastards!!).

> So what if you need end to end security for the contents of email? The
> solution here is PGP which can handle both encryption of the email 
> contents
> as well as "trust relationships" which enable you to know that the 
> sender is
> really the person who sent the email.

This is EXACTLY the avenue Jane wants to go down if she wants to 
suddenly set off EVERY SINGLE FLAG set for governmental email 
monitoring EVER WRITTEN.  The US Government has already shown how they 
feel about encryption of ANY kind, while still displaying their unusual 
and unreasonable hatred of PGP and the wicked person who invented it 
(probably to aid terrorists!!).

[*Ed. note: Phil Zimmerman links to Al Queda yet to be proven.]

> I know this all doesn't answer your question directly but the point is 
> you
> may not need that SSL cert depending on what you expect to accomplish.

Jane should listen to Scott.  He has eaten many brains.

> --
>   Scott
>   Do not trifle with me, I have eaten 104 brains.
> --

Like, somewhere around 100 brains, or something.

> Come and play at the InterNetWorkers Web site!  
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit 
> http://lists.ibiblio.org/mailman/listinfo/internetworkers

Why do they keep appending this garbage to every message I receive??  
This must be part of the filtering done by George Bush and his cronies. 
 Jane would be pissed if she had to put up with this crap!  ..hidden 
secret.. < http://www.homestarrunner.com/cheatvideo.html >