Hacker News Reader

I guess they can by brokering a deal with the bad actor in charge of your mail server. Unlikely but email is still bound to social manipulation.

View on HN

We're in the "you're screwed regardless" territory here - like having an ISP who intercepts TLS connections and substitutes content as you download it. There's no real way to work around that, though you might be able to detect it if there are unforgeable signatures on some of the content (e.g. DKIM signatures from third parties on incoming emails) - though the intermediate can strip those too, so all you see is "unsigned" rather than "modified".

> if there are unforgeable signatures on some of the content (e.g. DKIM signatures from third parties on incoming emails)

FWIW, in many cases content can be changed even if signed with DKIM without breaking the signature.

http://noxxi.de/research/breaking-dkim-on-purpose-and-by-cha...

I think email clients should be rethinking how they communicate to users whether or not an email is signed, e.g. if the headers haven't been oversigned and/or the full body hasn't been signed then it may be better to just show the message as having been not signed at all.

Part of the reason I download all my email to my PC.

Reply on news.ycombinator.com