I think this comment misses the point somewhat - the current crop of 'secure e-mail' plug-ins are little mosr than dirty hacks. The underlying system is still open, and can be readily abused regardless of what content layer protection is applied to the bodies of messages.

Products like PGP offer no way of certifying the identity of a hither-to unknown individual, and hence are useless for 'secure' or 'trusted' mail outwith closed groups of users.

What is needed is a closed e-mail system, that would allow identification and accountability by enforcing registration-time real world identity checks. This would need new, or modified mail transport protocols, servers and clients; and support and agreement from all affected parties. It could not be interoperable with the existing 'open' mail system.

However, this goes somewhat against the whole ethos of the Internet being an open and accessible global communication platform which, when considered along with the difficulties outlined above, is why I can't see it happening any time soon.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/404/33650#33650