[Full-Disclosure] Signed e-mail vs. turning off HTML mail under XP

[yossarian <yossarian@planet.nl>]

Today I had the pleasure of receiving a digitally signed e-mail on my newest
machine, running XP Pro. Since it is intended for business use, and
connected to the internet, I am about halfway hardening it. One of the
things I did was turn off HTML e-mail in OE (6 Sp1). On receiving a
digitally signed e-mail, I got OE asking me whether:


     Security Help
      Digitally Signed Message


        This message has been digitally signed by the sender.

      Signed e-mail from others allows you to verify the authenticity of a
message -- that the message is from the supposed sender and that it has not
been tampered with during transit. Signed mail messages are designated with
the signed mail icon.

      Any problems with a signed message will be described in a Security
Warning which may follow this one. If there are problems, you should
consider that the message was tampered with or was not from the supposed
sender.



  Don't show me this Help screen again.

Continue

Alas, the Continue button was just text, just as the tick box to not show me
this help screen again was not there. This means I'll have to re-enable HTML
mail, and wait for the next signed mail to arrive.....to turn it off. I
wonder what will happen to messages that have been tampered with when I have
turned off HTML mail? I will probably get a warning, but will not be able to
go beyond that, since it is in ASCII and that does not (AFAIK) support nice
buttons. So in order to enable signed mail, I will have to enable HTML in my
mail....

Have a nice day, ya'all

Yossarian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html