Hacker News Reader

Comment by withinboredom | Hacker News Reader

All emails are basically signed these days via DKIM by your mail service. Each server along the chain should also be signing them too, so your whole path is known and validated. You can validate those keys via DNS.

True story, I was an expert witness on a case once where I showed how the other guys were submitting forged emails into evidence -- by using DKIM signatures/hashes. That was probably some of the most fun I've ever had.

View on HN

I’ve always wondered about tampering of digital evidence like that, how much it might happen and not be detected, and what the penalty would be if it were.

Part of the work was explaining that a print out of an email is just a representation of the email, an actual email contains headers (like a digital stamp) that explain how the email got to where it is (in gmail -- "show original" -- that naming really helped, btw) and without it, you just have a piece of paper with words on it. The equivalent would be printing out the body of a newspaper article without the author or source. You have words, but you can't prove that it came from that newspaper unless someone else can corroborate it.

Email has been around long enough that it's hard to imagine someone submitting an email as evidence without including full headers. Do you think that it was done intentionally to trick the court or was it just incompetence?

As best as I can recall, Outlook for the Mac doesn’t have any way to see the full headers. I’m skeptical many people know the headers exist.

Good point! It used to be possible in outlook, but it looks like MS took that option away for years (WTF). Recently (within the last year) they said they brought it back. In Outlook 365 for Mac you should be able to right click on a message and select "View Source" to get the message with the full headers. That's the same way people did it in Outlook for Mac 2011

I agree, most people have no idea headers exist (beyond the short headers), but I expect lawyers and law enforcement to know better. Handling digital evidence is not new and at technology's timescale email is ancient.

You can but it is clunky. Save the email out as an .eml file and open it in an editor. You see all the headers.

It costs money and attention to insist on full headers. Unless the lawyers think there's something worth digging for, technical details would be omitted from copies just like they are in your email GUI.

And, on the other hand, either party can demand the other prove via live witness that the evidence is authentic, reliable and useful. If the witness isnt credible, the document can be excluded.

For reasons I can’t go into detail, but it was intentional and incredibly stupid.

Knowingly submitting fraudulent evidence is considered a pretty bad idea. Regardless if it is analog or digital.

DKIM helps for the headers the email provider chooses to sign (such as Subject), but does not attest as to the content of the message.

Incorrect, DKIM also signs the body of the message.

Only from the mail server to the receiving mail server.

You're right and I was wrong.

The DKIM signer selects a list of headers (h=) to be signed, but the body is always implicitly included (and thus not listed). I was confused because I thought there needed to be a flag to include it, and had never seen such from Gmail or others.

For anyone else that's curious: https://rfc-editor.org/rfc/rfc6376#section-3.7

Reply on news.ycombinator.com