Arthur Pemberton wrote:
>
> Could someone briefly fill me in on the if, why and how of email
> signing (I do not mean signatures). I am sure I can google the how,
> but I would like opions and experiences.
OK, I presume that you mean cryptographic signing. Message signing can
be done with either SMIME or PGP. Both accomplish the same thing, and
operate in virtually the same way.
Why sign? It's all about trust. If you reliably sign your messages,
the people with whom you exchange messages can configure their mail
client to trust the fingerprint of your certificate (or, they may trust
someone who signed your certificate). They can trust that a message
with your name on it, which has a valid signature, was written by you
and has not been tampered with. They should also learn not to trust
messages that have your name on it, but no signature.
Which method you choose probably will be influenced most by who,
exactly, you want to be able to verify your signatures. SMIME uses, in
large part, the same infrastructure that is already in virtually every
mail client to support SSL connections. That's one of the reasons that
SMIME is supported by nearly every major mail client available, out of
the box. PGP does pretty much exactly the same thing, but requires an
entirely separate infrastructure. I'm not aware of any major client
that supports PGP by default; they require plugins, mostly. That gives
SMIME a significant advantage if you want to sign messages, and have
that information be useful to a wide audience.
A follow up question which I haven't yet understood from Googling, what happens when my GPG signed email gets sent to my prof. who used Outlook?
--
As a boy I jumped through Windows, as a man I play with Penguins.
