So today I will keep Security Saturday short. I have some things in the works that take my time (both here and IRL). If you take anything away from today's post, it should be that e-mail was never a good idea and it remains terrible.
E-mail is one of the first communication channels I was accustomed to. I got an email address around the time they became a thing. My dad works in IT as a software architect, and gave us all email addresses (and webspace for HTML pages too) back then.
Email was never meant to be anything other than digital mail. You write the letter plain and simple, address it to the intended recipient and send it off. The delivery is not that straightforward, since the mail is shattered, sent in packages (usually over TCP-like connections, ensuring data integrity), reassembled every now and then to check if all pieces are there and then sent on.
Typically it makes three stops (but maybe more or less): Your outside-facing mail server, the recipients mail server, and then their specific mailbox. In between, anyone can read and modify the mail. No holds barred.
Other people can send mail in your name (used for phishing) they can adjust the mail content (used for social engineering) can steal your identity (in a million ways, really). Email is a bad idea.
So to fix that, the internet did decide it wanted legacy instead of a do-over. So now we have encrypted email, signed email, and (the horrible construct of) DMARC, DKIM and SPF. I spent a month setting that up once, and still 20% of my emails end up marked as spam or worse.
DMARC, DKIM and SPF are stupid abbreviations, and if you have Gmail, Outlook, or some other big provider, they fix that for you. If they did not, they would not get punished because they run most of the spam filters too. If I get it wrong, even if my SPF (Sender Policy Framework) says to bounce the email back with an explanation of why it is wrong, I will just have some of my e-mails lost in the clouds...
But I digress. If you want to communicate in a confidential manner, so not use email. Not even someone's hyper-encrypted super-duper uber-email. Just use Signal, Ricochet, Telegram, or even just IRC over Tor.
Because chances are even if you get the email signed, encrypted and past the spam filters with the right SPF, DMARC and DKIM, the recipient will not be able to read it because of some stupid issue with the decryption.
I spent three years on my master degree, and during those years several PhDs and Professors could not send email to me and others, and vice-versa. And I studied in the nerdiest part of the university. This should give you an idea of how bad encrypted mail really is.
And all this rant just because one reminder email did not reach one of my tutor students, while the test-mail earlier that week DID reach.
I severely dislike email, I think it should be replaced, I know it never will, rant over, stay safe out there!
There is so much more to this one chapter, but it is so good already!
I had to cut it short because guests arrived, but this should get you started on your own study :)
@calvinrempel Thank you once again for the Theology Tuesday you did, I refer back to it in this one :)
@JamesDerian Congratulations with your Marriage :)
Next time there might (almost certainly) not be a Theology Tuesday, so the official next one will be February 22nd! I have a marriage to attend. As the groom. Our home is still half a project.
Fun times!
Alc and I talk about my book that is now officially finished. This is part 1 of 2. Parts have not been neatly cut. Part two will air 5 minutes after part 1 for coninuity!
Hope you enjoy :)
This is the third corner to have persistent discussions and talks in. I love tech, but especially once it transcends hardware a little. I have two degrees; a bachelor's in Software Engineering and a master's in Information Security Technology. My graduation thesis focused on assembly-level optimizations (that is, one level above the hardware level) and my free subjects were in formal verification. This is why I love programming in the security corner, or maybe it is the other way around.
I started going down the Security path because I early on saw that the world around us would become a dangerous cesspool of badly-implemented and hostile tech. Now I am one of the people that understands the field around that mess :)
So in here you can discuss secure phones, weird programming languages, sad truths about internet-connected fridges. Also about malware, adblockers, and so on and so fort!
A lot of tech talk I do over at the @Lunduke community, where a lot of nerds hang out and it is ...
Much like the reading corner, let's have a music corner! A few rules for this one, since some music can be provocative. I don't mind much but let's keep youtube links with risque thumbnails out of here.
Other music I might also mind. "Do you find that offensive?" might someone ask. Yes, there is some music I choose not to listen on principle, and I walk a thin line there sometimes. But do not worry, I have a wide taste otherwise so feel free to share almost anything :)
Either way, here is the music corner!
Many times when we talk about security, we mean to say "Digital security". In essence we mean to say that our hardware and software that we use stays safe no matter what we do. And even though the ISO27001 standard (and by extension, for example, the NEN7510 standard) make it abundantly clear that security is a people-domain problem, we usually take that as a process-like truth. Meaning, we think that being secure is a matter of regulating people.
The truth is very different. For example, while writing this I am pretty shot. I slept five hours and I an under influence of a bunch of painkillers and some alcohol. Before you ask what I was thinking, let me mention that I have a genetic defect in my spine that I am dealing with right now by taking measured doses of all three (and yes, to get the Bible into this conversation, there is even a biblical ground for the inebriation with alcohol - see proverbs and the letters to Timothy - , although I did not use red wine. But hey, I am still on top of ...
