http://www.ritlabs.com New posts in How to prove the authenticity of an email? of forum at www.ritlabs.com [www.ritlabs.com] en http://backend.userland.com/rss2 Thu, 04 Feb 2010 03:04:08 +0200 How to prove the authenticity of an email? in forum The Bat! - Configuring the E-mail Client.
The fact that you've got a message on your pc doesn't prove that it has been sent, it even doesn't prove that you didn't alter it after sending.
Not even a valid PGP or MIME signature doesn't prove that it was really signed on the moment of the signatiure, because you could have altered the date of your computer while signing it.

Thge only thing that might be considered proof of sending is your log file, but honsety compells me to say that I'd be able to alter the log accordingly, even when you're an encrypted message base (and also encrypted logs)

In some countries ISPs are obligated to store messages from and to their clients. Those logs/transcripts should be considered proof if you can get them.

For the rest you'd need signed confirmation receipts.
04 February 2010 03:04:08, Roelof Otten.]]> http://www.ritlabs.com/en/forums/forum4/topic9137/message31172/ http://www.ritlabs.com/en/forums/forum4/topic9137/message31172/ Thu, 04 Feb 2010 03:04:08 +0200 The Bat! - Configuring the E-mail Client How to prove the authenticity of an email? in forum The Bat! - Configuring the E-mail Client.
Hello,

I am on a lawsuit and I have to prove juridically and technically that I sent some mails from my PC.

Obviously  I know I sent them but I have to prove it. So I first tried to  read  RFC-822  headers  hoping  to see the SMTP server in order to contact  my  ISP  provider. But unfortunately on POP3 accounts The Bat
doesn't indicate the smtp server on the headers.

My  question is quite simple. Which element(s) can prove the authenticity of an mail that is stored on my pc?

The message-ID can prove something? It is a sure indicator or it could be easily modified or forged? The same for the "References" field.

If I had bad intentions, could I easily modify the structure of a mail on  my  PC  or not (date, subject, sender, recipient, content...)? How secured is The Bat from this point of view?

I  hope  it's  clear  but I would like to prove that I sent some mails from  my  PC,  at  a  particular date, to a particular recipient with a particular content. And I would like to know what is the best way to prove it.

Any idea?

From  this  particular point of view there is a difference between The Bat Pro and The Bat Pro + Hardware Token Key?

See: http://www.ritlabs.com/en/products/securebat/index.php

Thanks a lot
04 February 2010 02:19:48, duralux duralux.]]> http://www.ritlabs.com/en/forums/forum4/topic9137/message31171/ http://www.ritlabs.com/en/forums/forum4/topic9137/message31171/ Thu, 04 Feb 2010 02:19:48 +0200 The Bat! - Configuring the E-mail Client