OpenPGP-signed messages on Usenet: current best practice

[Tristan Miller]

Greetings.

Is there any consensus on the posting of OpenPGP-signed articles to
non-binary newsgroups? Are they welcome or hated? Are they considered
binary attachments? About what proportion of Usenet readers are using a
newsreader that recognizes and correctly processes (i.e., verify the
signature if PGP/GnuPG software is installed, otherwise ignore but
indicate that a signature is present) PGP-signed articles?

I know, for example, that Microsoft Outlook Express's handling of
OpenPGP-signed mail is terrible -- it presents a blank message with both
the text and digital signature parts as attachments, and doesn't identify
the signature as a signature, so Outlook Express users often write me back
saying, "I couldn't open your second attachment!". Does Outlook Express
(or other popular newsreaders) do the same thing for signed newsgroup
articles?

Regards,
Tristan

[Tom McCune]

Post by Tristan Miller
Greetings.
Is there any consensus on the posting of OpenPGP-signed articles to
non-binary newsgroups? Are they welcome or hated? Are they considered
binary attachments? About what proportion of Usenet readers are using a
newsreader that recognizes and correctly processes (i.e., verify the
signature if PGP/GnuPG software is installed, otherwise ignore but
indicate that a signature is present) PGP-signed articles?
I know, for example, that Microsoft Outlook Express's handling of
OpenPGP-signed mail is terrible -- it presents a blank message with both
the text and digital signature parts as attachments, and doesn't
identify the signature as a signature, so Outlook Express users often
write me back saying, "I couldn't open your second attachment!". Does
Outlook Express (or other popular newsreaders) do the same thing for
signed newsgroup articles?

I can only give my two cents on this.

People in non-PGP related newsgroups don't want to be bothered with PGP
signed messages at all. They find it irritating, and don't understand any
reason for it.

When you refer to OpenPGP and attachments, I think you are referring to use
of PGP/MIME? While I am a big time PGP fan, and use inline clearsigning in
PGP newsgroups and email lists, I personally dislike attachments of any
kind - if people use secure software (for this purpose, I am largely
thinking non-Microsoft) and don't open attachments that they don't have
really good reason to believe are safe, viruses, etc., would be much less
of a problem.

[David E. Ross]

Post by Tristan Miller
Greetings.
Is there any consensus on the posting of OpenPGP-signed articles to
non-binary newsgroups? Are they welcome or hated? Are they considered
binary attachments? About what proportion of Usenet readers are using a
newsreader that recognizes and correctly processes (i.e., verify the
signature if PGP/GnuPG software is installed, otherwise ignore but
indicate that a signature is present) PGP-signed articles?
I know, for example, that Microsoft Outlook Express's handling of
OpenPGP-signed mail is terrible -- it presents a blank message with both
the text and digital signature parts as attachments, and doesn't identify
the signature as a signature, so Outlook Express users often write me back
saying, "I couldn't open your second attachment!". Does Outlook Express
(or other popular newsreaders) do the same thing for signed newsgroup
articles?
Regards,
Tristan

I only sign newsgroup messages when the authenticity is important.
Early in 1998, I was an official proponent of the proposed
reorganization of a Usenet newsgroup. The discussion of this proposal
(via newsgroup messages) was more than vigorous or even heated. At
times, it was nasty and vitriolic.

During that discussion, messages began to appear in which I indicated a
change of mind. According to these messages, I now opposed the proposal.
These messages were, of course, fakes with forged headers that used my
E-mail address. I quickly halted this fraud. I sent a message to the
newsgroup to alert the participants that fake messages were appearing
under my name. This message, however, was signed with my PGP key. The
text warned others that any message without my signature was a fake; it
also described how to obtain my PGP key. The warning informed the other
participants that, not only should they look for the signature, but they
should also verify it to ensure that no one else had altered the message
and that no one attempted to submit a forged message after copying my
signature from another, authentic message that I had signed.

[Matt Westfall]

Yeah I quickly realized that the best thing is to avoid PGP/MIME for the
time being. Anybody without a PGP/MIME capable client will not be able
to read ANY of your message.

At least if you use an inline signature, all they have to do is ignore
the top two lines of text.

Also, you can't do PGP/MIME S/MIME at the same time.

So if you want to sign with both PGP and a Certificate, you are FORCED
to use Inline PGP.

Until PGP/MIME finds it's way into more e-mail clients standard, you
might as well just stick with inline.

If someone wants to whine about the top two lines, let em, lol.

It would be nice if Thunderbird supported PGP OOB, but even with the
extension you still have to install GnuPG.

Post by Tristan Miller
Greetings.
Is there any consensus on the posting of OpenPGP-signed articles to
non-binary newsgroups? Are they welcome or hated? Are they considered
binary attachments? About what proportion of Usenet readers are using a
newsreader that recognizes and correctly processes (i.e., verify the
signature if PGP/GnuPG software is installed, otherwise ignore but
indicate that a signature is present) PGP-signed articles?
I know, for example, that Microsoft Outlook Express's handling of
OpenPGP-signed mail is terrible -- it presents a blank message with both
the text and digital signature parts as attachments, and doesn't identify
the signature as a signature, so Outlook Express users often write me back
saying, "I couldn't open your second attachment!". Does Outlook Express
(or other popular newsreaders) do the same thing for signed newsgroup
articles?
Regards,
Tristan

[Tom McCune]

Matt Westfall <***@fiftypounds.com> wrote in news:BMidnaO2i_YEk9XZRVn-***@comcast.com:

<snip>

Post by Matt Westfall
Until PGP/MIME finds it's way into more e-mail clients standard, you
might as well just stick with inline.

<snip>

I am definitely not a fan of PGP/MIME (mostly because I don't like/trust
email attachments). However, one of the really nice things about PGP 9.x
is that the email proxy makes just about all email clients PGP/MIME
compatible.

[Matt Westfall]

True tom True.

I'm not trying to pay for PGP functionality though, lol.

And actually, thunderbird makes the PGP/MIME stuff go away and it just
turns it into a message and says "good signature" and / or "Decrypted"
up top.

Matt Westfall
Owner / Operator
FiftyPounds Internet
http://www.fiftypounds.com

This message is digitally signed with Pretty Good Privacy (PGP)
Info: http://en.wikipedia.org/wiki/Pretty_Good_Privacy

Post by Tom McCune
<snip>

Post by Matt Westfall
Until PGP/MIME finds it's way into more e-mail clients standard, you
might as well just stick with inline.

<snip>
I am definitely not a fan of PGP/MIME (mostly because I don't like/trust
email attachments). However, one of the really nice things about PGP 9.x
is that the email proxy makes just about all email clients PGP/MIME
compatible.