Lotus Notes Encryption Bug

From: Martin Bartosch (bartoschat_private)
Date: Fri Mar 26 1999 - 01:24:06 PST

  • Next message: Aleph One: "Re: ftp exploit"

    IAKOVLEVat_private wrote:
    
    >  Do you want to say that if you use only the backslashes in the path to
    > the mailbox (ex. mail\path\to\user.nsf) and DO NOT check the "Encrypt
    > saved mail" box, the saved mail will still be encrypted?
    
    Yes - if the product functions correctly AND if you select "encrypt mail"
    in the mail options while composing the new mail note. As far as I can
    verify this, the saved mail stored in the "Sent mail" folder is encrypted
    when these conditions are met - even if "encrypt saved mail" and "encrypt
    sent mail" are NOT checked.
    
    >  It is reasonable to expect that if you do not check the "Encrypt saved
    > mail" box, the respective message is stored in clear in the mail
    > database, and as such is recoverable via sniffing the network traffic,
    > be it the initial mail copy storing on the remote server, or any
    > replication (via the network) of the database, unless you encrypt the
    > network traffic, by checking the respective box in the File -> Tools ->
    > User Preferences ->Ports menu.
    
    I disagree: when a user composes a mail and specifically requests
    encryption for this mail she has good reason to believe that the product
    will not pass any clear text of this message over the wire or store plain
    text on external systems - regardless of any global settings elsewhere.
    
    In my opinion it is reasonable to expect that if I request encryption by
    *any* means within the client, I do not want the clear text to leak out.
    And I wish to be told about any problems if my software cannot perform
    this action properly for some reason.
    
    In addition I do not think that the "enrypt network traffic" option does
    help a lot - the message is still stored on the server in the plain.
    
    
    Regards,
    
    Martin
    
    --
    Martin Bartosch                                       bartoschat_private
    
    This message and any statements expressed therein are those of myself
    and not of the Deutsche Bank AG or its subsidiary companies.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:39:59 PDT