Re: [OT] Bogus undelivered message
On Wed, Jun 11, 2003 at 09:11:21PM -0400, Mike M wrote:
> On Wednesday 11 June 2003 16:39, Karsten M. Self wrote:
> > If you want your messages authenticated, sign them.
>
> I just started with GPG and I'm still learning. I need some
> clarification on the advice above. Are you saying that by signing all
> emails, then I can positively distinguish real undelivered from bogus
> undelivered because the bogus ones will not have my digital signature?
Erm, kind of, but not securely. If for example you sent a signed message
to a mailing list, then anybody can take that signed message and send it
back to you. This is known as a "replay attack", although it's not a
serious problem unless you do something important based on receiving
such messages. Mail filtering generally isn't important to that extent.
Recent spam has been known to resend fragments of messages sent to
mailing lists.
--
Colin Watson [cjwatson@flatline.org.uk]
Reply to: