Roch Viviene said:
sugestion: every user in this newsgroups could be authentificated
with a certificate, or only who wants to. with this everyone who
wants could show his real identity, and could be verified.
if is possible?
Yes, you can digitally sign your posts. Unfortunately Outlook Express
doesn't know how to properly handle PGP digital signatures and shows the
PGP hash data inside the message body instead of as an attachment. I've
even seen where PGP-signed messages show as a blank body and the message
is in a .txt attachment (i.e., OE moved all the body into an attachment
instead of just the MIME parts for the digital signature). Presumably
(i.e., hopefully) OE knows how to handle x.509 certs correctly since
that's the only type of certs it really knows how to handle.
There's a "Sam" that posts in comp.mail.misc that always PGP digitally
signs his posts, you end up seeing a blank body for his post, and you
have to open the .txt attachment to see what he said. OE doesn't obey
the "Content-Disposition: inline" directive, when specified or implied
(since "attach" should be the default behavior) when "Content-Type:
application/pgp-signature". In other words, OE has problems with
MIME-signed messages when PGP is used
(ftp://ftp.rfc-editor.org/in-notes/rfc3156.txt), so instead of showing
those MIME parts with disposition "inline" it instead isolates them as
attachments. For example, the raw data for a message (bracketed below
between the underscore lines) might be:
________________________________________
<other headers>
Mime-Version: 1.0
Content-Type: multipart/signed;
boundary="=_mimegpg-commodore.email-scan.com-3514-1096456268-0002";
micalg=pgp-sha1; protocol="application/pgp-signature"
<otherheaders>
This is a MIME GnuPG-signed message. If you see this text, it means
that
your E-mail or Usenet software does not support MIME signed messages.
--=_mimegpg-commodore.email-scan.com-3514-1096456268-0002
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
This is the message that you are supposed to see within the
view
window of your NNTP client.
--=_mimegpg-commodore.email-scan.com-3514-1096456268-0002
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQBBWphMx9p3GYHlUOIRAgqGAJ9GyGI+qo0M22QtGIgnNmBQPGJFFgCfddZq
9teEz4KYNF42URLnAtudl7s=
=cOZh
-----END PGP SIGNATURE-----
--=_mimegpg-commodore.email-scan.com-3514-1096456268-0002--
________________________________________
The disposition of "inline" should have showed the message body within
your client's view window. The default disposition is "attach" so the
other MIME part (for the PGP signature) should have been displayed as an
attachment in your client. I've seen OE screw up in two different ways.
One has OE treating it all as disposition=attach (i.e., ignores the MIME
part with disposition=inline) and you have to read the message as a .txt
attachment. The other is with OE showing it all in the body of the
message, so you have to wade past the first non-MIME part, see the
disposition=inline part (which is the message), and then wade past the
PGP signature part (which should've been an attachment). Even Outlook
has problems regarding inline content
(http://support.microsoft.com/?id=814111).
I haven't seen many folks signing their newsgroup posts. Sam was an
example of how PGP does it (as Sam has configured it), and OE doesn't
correctly handle PGP-signed messages. I don't have an example of
someone posting with x.509-signed messages to see how OE handles those
or what MIME coding is used for those. If signing gets more prevalent
to identify posters then it would also be nice if OE got fixed to handle
them correctly. I, for one, don't want all the PGP signature "trash"
mixed in with the message.
The other problem with digital signatures is that they don't always
identify the sender. If you use Thawte freemail certs, you are never
identified except by your e-mail address (which could be a disposable
freebie webmail address or even an e-mail alias). Unless you bother to
go through their Web-o-trust mechanism to get more information put into
your Thawte cert then it is really a bogus cert. About the only thing a
Thawte cert is good for is to encrypt your message sent to someone that
already knows you (i.e., to them you are a trusted sender). The digital
"signature" in a Thawte cert is worthless. Anyone can get one and never
really identify who they are.
