So to find out how hard this was I recently tried to setup smime, and it actually isn't really that hard. No plugins required and fully integrated with Mall.app on mac, and my iOS devices. For easy steps on how to do this see here:
What make s/mime easy to use is that those who receive the smime attachment on compatible software can see and validate signatures even without setting up their own s/mime identity. They can also accept your public key so when they do setup s/mime they are ready to encrypt message to you just using the signature attachment on one of your messages.
So s/mime at least has an intermediate value even if you are the only one of your friends using it. You can sign things and they can confirm your signature.
Also gpgtools (https://gpgtools.org) just released a new version that has a plugin for the latest Mail.app. However, public key infrastructure is a little more complicated process, and you'll have to explicitly acquire each person's key, and a signatures can not be validated until the recipient also has gpgtools installed.
As an ex cypherpunk, s/mime seems to have a number of security issues with it. First is how it is generated. When I got my cert from COMODO as outlined above the file was saved from the web browser to my downloads file. This struck me as odd. Does this mean they could have copy of my cert? This is convenient, but keys should be generated securely by the user on their own machine.
Also there is the issue of security in terms of how does the signature work. Does it sign then encrypt, or encrypt then sign, or sign then encrypt then sign again? See the non accepted answer by Adam Liss for a discussion of the security issues of this here:
Nevertheless s/mime works well in many tools and on iOS devices, and is not nearly as hard as most people think. Someone who wants to sell certs could make a video that even grandma could follow.
> When I got my cert from COMODO as outlined above the file was saved from the web browser to my downloads file. This struck me as odd. Does this mean they could have copy of my cert?
There are client-side APIs (e.g. Blob+<a download> or FileSaver.js) for saving locally generated files from JS, though I have no idea if COMODO uses them.
In an enterprise environment (in other words, Active Directory, Exchange, and Outlook), e-mail encryption (S/MIME) can even be rolled out and centrally managed with zero effort from an end user.
http://arstechnica.com/apple/2011/10/secure-your-e-mail-unde...
You can get a free cert from COMODO:
http://www.comodo.com/home/email-security/free-email-certifi...
What make s/mime easy to use is that those who receive the smime attachment on compatible software can see and validate signatures even without setting up their own s/mime identity. They can also accept your public key so when they do setup s/mime they are ready to encrypt message to you just using the signature attachment on one of your messages.
So s/mime at least has an intermediate value even if you are the only one of your friends using it. You can sign things and they can confirm your signature.
Also gpgtools (https://gpgtools.org) just released a new version that has a plugin for the latest Mail.app. However, public key infrastructure is a little more complicated process, and you'll have to explicitly acquire each person's key, and a signatures can not be validated until the recipient also has gpgtools installed.
As an ex cypherpunk, s/mime seems to have a number of security issues with it. First is how it is generated. When I got my cert from COMODO as outlined above the file was saved from the web browser to my downloads file. This struck me as odd. Does this mean they could have copy of my cert? This is convenient, but keys should be generated securely by the user on their own machine.
Also there is the issue of security in terms of how does the signature work. Does it sign then encrypt, or encrypt then sign, or sign then encrypt then sign again? See the non accepted answer by Adam Liss for a discussion of the security issues of this here:
http://stackoverflow.com/questions/13512026/how-to-check-if-...
Nevertheless s/mime works well in many tools and on iOS devices, and is not nearly as hard as most people think. Someone who wants to sell certs could make a video that even grandma could follow.