|
Why bother encrypting a mailing list? What does it gain you, and why not go all the way and use an anonymous remailer? I expect you, the reader, to be reading this article from one of two viewpoints: Perhaps you don't see the value in encrypting mail that you don't view as "sensitive," and don't commonly encrypt mail, even for people you have keys for. A couple of interesting links for you. Completely independent of government attention, I think it's a good idea to encrypt all the email that is possible to encrypt. A bored sysadmin for your email server, a nosy PI with a friend at an ISP, why bother sending all your mail via postcard when you can put it in an envelope? OK, regardless of how good an idea encrypting all the email that is feasible to encrypt is, it's kinda out of scope for this discussion. Hopefully you encrypt. If not, feel free to email me for a more in depth debate/Q&A session, etc. You don't even need to encrypt it. ^_^ Or check this out. The other viewpoint I'd be expecting to be reading this article is worried about the lackadaisical attitude an encrypted mailing list is taking towards privacy. After all, don't anonymous remailers solve many of the same problems? Shouldn't you just have a well-populated keyring, and send email to the people you intend to send email to? Shouldn't the PGP web of trust handle key verification? Couldn't a curious attacker simply subscribe to the encrypted mailing list to find out what's going on? All good questions. Let me take them in the order I postulated them. Anonymous remailers are excellent for the problem they're trying to solve, but seem to have a problem scrubbing spam. They're also difficult to set up. But yeah, if you're not only trying to protect the contents of your messages, but the fact that you're communicating, there's no substitute. The niche has been filled, though. I see another niche. Why not just use web of trust to handle key verification and send email to who you mean to send email to? That does indeed provide higher security, no bones about it. But really, mailing lists are a convenient forum, wherein you can talk to people you don't already know. If it's a publically available mailing list, then yeah, a potential eavesdropper could subscribe to the list and read it that way, but we've forced the eavesdropper from a passive mode into an active one, where the list owner now has a log of who has received messages. Also, if the mailing list is not publically available, then what you are essentially doing is trusting the owner of the list, but in the context of that list only. This is a flexibility not addressed by the web of trust models. It's my hope that providing software that can be used to easily encrypt mailing lists will increase the overall use of cryptography, getting more bytes off of the postcards and into the envelopes. Didn't answer your questions sufficiently? Email me. |