full-disclosure - Signed e-mail vs. turning off HTML mail under XP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: yossarian at planet.nl (yossarian)
Subject: Signed e-mail vs. turning off HTML mail under XP

Today I had the pleasure of receiving a digitally signed e-mail on my newest
machine, running XP Pro. Since it is intended for business use, and
connected to the internet, I am about halfway hardening it. One of the
things I did was turn off HTML e-mail in OE (6 Sp1). On receiving a
digitally signed e-mail, I got OE asking me whether:

     Security Help
      Digitally Signed Message

        This message has been digitally signed by the sender.

      Signed e-mail from others allows you to verify the authenticity of a
message -- that the message is from the supposed sender and that it has not
been tampered with during transit. Signed mail messages are designated with
the signed mail icon.

      Any problems with a signed message will be described in a Security
Warning which may follow this one. If there are problems, you should
consider that the message was tampered with or was not from the supposed
sender.

  Don't show me this Help screen again.

Continue

Alas, the Continue button was just text, just as the tick box to not show me
this help screen again was not there. This means I'll have to re-enable HTML
mail, and wait for the next signed mail to arrive.....to turn it off. I
wonder what will happen to messages that have been tampered with when I have
turned off HTML mail? I will probably get a warning, but will not be able to
go beyond that, since it is in ASCII and that does not (AFAIK) support nice
buttons. So in order to enable signed mail, I will have to enable HTML in my
mail....

Have a nice day, ya'all

Yossarian