Eudora 7.1 and S/MIME

[Citizen Bob]

I am starting a new thread for this topic because it deserves a
separate discussion.

I am considering implementing S/MIME in my new Eud 7.1. Previously in
3.0.5 I used PGP5 (which was the last known version that was not
rigged by the NSA - before PGPI came along).

So I am wondering if any of you have experience with installing S/MIME
and email Certificates. I have read the following:

http://www.thawte.com/secure-email/personal-email-certificates/email_business.html
http://eudora.com/techsupport/kb/2691hq.html
http://www.eudora.com/download/eudora/windows/7.0/SMIME_Readme.txt
http://www.iconexplorer.com/Internet/Email/SMIME_Plugin_for_Eudora_7959.htm
http://www.sharelibrary.com/Internet/Email/SMIME_Plugin_for_Eudora06060456.htm
http://www.softforall.com/Internet/Email/SMIME_Plugin_for_Eudora06060456.htm

BTW, does anyone know how to shut off the popup blocker in IE 5.5? I
read that to get Certificates to work properly with Windows, you need
to install them with IE. But the link at the Thawte site is a popup
and for some unknown reason IE is blocking them. Mozilla is my default
browser - I rarely use IE.


--

Ban Dihydrogen Monoxide (DHMO)!
Primary Cause of Global Warming!

The DHMO Institute
Houston, Texas

http://home.houston.rr.com/rkba/dhmo.html

[John H Meyers]

On Fri, 23 Mar 2007 03:50:36 -0500, Citizen Bob wrote:

[included some links to an "S/MIME Plugin for Eudora 1.0"
(is that a *Eudora* version number?) from "Cryptigo" -- for $19.50]

The *free* plugin for Eudora 7 (may also work with v6)
from Qualcomm:
http://www.eudora.com/download/
http://www.eudora.com/cgi-bin/export.cgi?productid=3DEUDORA_win_smime_70=


General announcements from Qualcomm re S/MIME:
http://www.eudora.com/email/features/windows/
http://www.eudora.com/newsletter/200602/
http://www.eudora.com/newsletter/200602/#Security
http://www.eudora.com/press/2005/eudora_7_11.15.05.html
http://www.eudora.com/download/eudora/windows/7.1/RelNotes.txt

-[ ]-

[John H Meyers]

[more remarks about a vendor's unknown "S/MIME Plugin for Eudora 1.0"
for $19.50, vs. Qualcomm's free plugin for Eudora 7 (maybe v6 too)]

The vendor's download is a Windows *executable* program,
also either containing or using other Windows DLLs.

The Qualcomm download is a single file "SMIME.DLL"
to store in the Eudora "Plugins" directory
(plus an "SMIME_Readme.txt" file, in the Zip).

I'd go for the latter.

-[ ]-

[Citizen Bob]

On Fri, 23 Mar 2007 06:27:20 -0500, "John H Meyers"

Post by John H Meyers
[more remarks about a vendor's unknown "S/MIME Plugin for Eudora 1.0"
for $19.50, vs. Qualcomm's free plugin for Eudora 7 (maybe v6 too)]
The vendor's download is a Windows *executable* program,
also either containing or using other Windows DLLs.
The Qualcomm download is a single file "SMIME.DLL"
to store in the Eudora "Plugins" directory
(plus an "SMIME_Readme.txt" file, in the Zip).
I'd go for the latter.

I just downloaded the zip from Eudora.

I want to stay as steet-legal as possible.

Now I need to get a Certificate, presumably from Thawte. But I need to
use IE 5.5 to install it. However my IE is blocking popups for some
strange reason. Does anyone know how to turn that off?

Maybe I need to relax the Internet Security setting in IE for this
installation.

Any help on Certificate install and use would be appreciated.

I have a public key on the PGP server at MIT, so I am almost there.


--

Ban Dihydrogen Monoxide (DHMO)!
Primary Cause of Global Warming!

The DHMO Institute
Houston, Texas

http://home.houston.rr.com/rkba/dhmo.html

[John H Meyers]

Post by Citizen Bob
Now I need to get a Certificate, presumably from Thawte.
I have a public key on the PGP server at MIT, so I am almost there.

S/MIME and PGP are independent, unrelated systems.

With PGP/GPG, you (aided by PGP software) take responsibility
for generating and keeping your own public-private key pair,
and for distributing your public key and holding your private key
(independently from your computer OS);
individual PGP users can make private arrangements
for "signing" each others keys as they see fit,
there being no "central authorities" in this "web of trust."

S/MIME stores your key pair in the certificate itself,
which is "signed" by some recognized authority --
either one of the few recognized "top" authorities (CA),
or a lower CA which in turn is validated by a higher CA;
because of the heierarchical validation system,
no other publication of public keys is needed
(that same heierarchy also implies control,
and usually fees, whereas everything in PGP/GPG
can be obtained entirely free and uncontrolled).

The computer OS has to "install" S/MIME certificates
(not too portable without your own computer at hand),
and Eudora (via a necessary plugin) makes use
of your certificate; with PGP, plugins are optional,
because PGP can also interface with *any* applications,
even manually, through your use of the OS clipboard
(or it can interact with any "current window" in your OS).

PGP is in fact so universal and portable
that you can even use it through a "webmail" service
that you can access from *any* computer having internet access
(see hushmail.com), all without carrying around
any keys or certificates at all.

PGP software also usually can independently encrypt files,
"sign" and encrypt any other documents, create and compress
self-extracting encrypted archives (like WinZip),
"wipe" (securely erase) data, and even encrypt
entire computer drives -- more versatile than just for email.

At any rate, S/MIME and PGP don't inter-operate,
but you can choose one, or you can install both and choose
which one to use for each individual correspondent.

-[ ]-

[Citizen Bob]

On Fri, 23 Mar 2007 15:35:57 -0500, "John H Meyers"

Post by John H Meyers

Post by Citizen Bob
Now I need to get a Certificate, presumably from Thawte.
I have a public key on the PGP server at MIT, so I am almost there.

S/MIME and PGP are independent, unrelated systems.
With PGP/GPG, you (aided by PGP software) take responsibility
for generating and keeping your own public-private key pair,
and for distributing your public key and holding your private key
(independently from your computer OS);
individual PGP users can make private arrangements
for "signing" each others keys as they see fit,
there being no "central authorities" in this "web of trust."
S/MIME stores your key pair in the certificate itself,
which is "signed" by some recognized authority --
either one of the few recognized "top" authorities (CA),
or a lower CA which in turn is validated by a higher CA;
because of the heierarchical validation system,
no other publication of public keys is needed
(that same heierarchy also implies control,
and usually fees, whereas everything in PGP/GPG
can be obtained entirely free and uncontrolled).
The computer OS has to "install" S/MIME certificates
(not too portable without your own computer at hand),
and Eudora (via a necessary plugin) makes use
of your certificate; with PGP, plugins are optional,
because PGP can also interface with *any* applications,
even manually, through your use of the OS clipboard
(or it can interact with any "current window" in your OS).
PGP is in fact so universal and portable
that you can even use it through a "webmail" service
that you can access from *any* computer having internet access
(see hushmail.com), all without carrying around
any keys or certificates at all.
PGP software also usually can independently encrypt files,
"sign" and encrypt any other documents, create and compress
self-extracting encrypted archives (like WinZip),
"wipe" (securely erase) data, and even encrypt
entire computer drives -- more versatile than just for email.
At any rate, S/MIME and PGP don't inter-operate,
but you can choose one, or you can install both and choose
which one to use for each individual correspondent.

I now have both installed and as soon as I figure out how to ger IE
5.5 to allow popups I will get a Thawte Certificate installed.

The problem with PGP is that most people don't know what it is, and
furthermore they don't want to learn. With S/MIME, as you pointed out,
the machinery is hidden from the user, so once they install it - which
appears to be simple enough - they can click a couple buttons and
send/receive encrypted email. Or so it would seem.

I was an old PGP hack back in the days of MS-DOS. But most Internet
users aren't so, I am forced to accept the adage "when in Rome...".

How many people do you know who can explain what "ASCII Armor" is,
much less why it is useful in PGP?

[John H Meyers]

Post by Citizen Bob
The problem with PGP is that most people don't know what it is, and
furthermore they don't want to learn. With S/MIME, as you pointed out,
the machinery is hidden from the user, so once they install it - which
appears to be simple enough - they can click a couple buttons and
send/receive encrypted email. Or so it would seem.
I was an old PGP hack back in the days of MS-DOS. But most Internet
users aren't so, I am forced to accept the adage "when in Rome...".
How many people do you know who can explain what "ASCII Armor" is,
much less why it is useful in PGP?

Modern PGP integrates with the most popular modern email clients
about as seamlessly as S/MIME, though I don't know what the
situation is with respect to PGP or GPG and Eudora 7.

It could be confusing for *you* if you had two toolbar buttons
each, for "Encrypt/Sign" etc. (one for S/MIME and another for PGP),
but if you managed to use MS-DOS PGP (once upon a time so did I),
you could easily manage use of PGP via "Current Window" or clipboard,
while to the person at the *other* end, using Outlook, say
(or anything fully supported), PGP on *their* side
would be totally integrated.

In other words, when you're using your phone,
the person at the other end is completely oblivious
to the fact that you're sitting on the pot, naked
(unless you've accidentally turned on your cell phone camera :)

I'm not trying to push PGP/GPG instead of S/MIME,
but I seem to feel motivated to point out when the painted picture
is a bit misaligned as to the principles of perspective;
besides, there's no TV in here,
so there's nothing else to do but write :)

-[ ]-

[Citizen Bob]

On Fri, 23 Mar 2007 06:12:07 -0500, "John H Meyers"

Post by John H Meyers
The *free* plugin for Eudora 7 (may also work with v6)
http://www.eudora.com/download/

I just got it. That page was not available as far I could see on the
Eudora Home page.

Post by John H Meyers
http://www.eudora.com/email/features/windows/
http://www.eudora.com/newsletter/200602/
http://www.eudora.com/newsletter/200602/#Security
http://www.eudora.com/press/2005/eudora_7_11.15.05.html
http://www.eudora.com/download/eudora/windows/7.1/RelNotes.txt

I just got them all.

--

Ban Dihydrogen Monoxide (DHMO)!
Primary Cause of Global Warming!

The DHMO Institute
Houston, Texas

http://home.houston.rr.com/rkba/dhmo.html