Warning - scams

[Ed Davies]

3 hours ago, AnonymousBosch said:

OK Ed, how do I digitally sign an email?

 

@JSHarris gave some reasonable links for background. More specifically, I use Thunderbird for all my email (and have since it was Netscape Communicator) which has a plugin called Enigmail which handles it reasonably straightforwardly once you understand the basics of public and private keys, etc.

 

The underlying Pretty Good Privacy (OpenPGP) standard and its most common implementation, GNU Privacy Guard (GPG, which Enigmail uses behind the scenes), are pretty gnarly to use but there's been a steady stream of standard setting, etc, to paper over the cracks. In particular, the original idea of PGP was that people would verify and sign each other's keys then other people who knew them could know to trust further keys via what was called the web of trust. This sort of worked in some circles but never really took off more widely. Now there's more of a move to automatically include key information in the email header to use a principle of trust-on-first-use (TOFU) so you build up trust in a key via a conversation and get an alert if somebody suddenly seems to start using a different key.  This is also the way the more secure messaging services like Signal work.

 

It's not something that'll be universally adopted overnight but a steady move to more signing and encryption would help a lot with security, IMHO.

 

36 minutes ago, ProDave said:

When I asked what has she been doing the reply was "people keep sending me emails saying I have won some money so of course I click on the link"

 

OTOH, it's the software that's fundamentally broken, not your MiL, if clicking on a link can install malware.

 

Telling people not to click links is just a temporary workaround at best. Telling people not to put private information into websites they haven't verified might be more useful if verification was a bit easier.