Ridiculous or not, I'm getting a lot of them these days. If I were a
spammer, I would be very interested in intercepting valid signed
messages and turning them into ASCII art in a way that preservesd the
signature.
Having said that, I'm not sure we should worry about it. I
don't have
a very high opinion of the technical competence of the average user,
but I think the idea that most ASCII art messages are not to
be trusted
is something that we can socialize widely.
I have been spending some time looking at why crypto systems fail. There
are two reasons that are relevant to this argument:
1) The system has a major flaw that is easily exploited by an attacker.
2) The system is never deployed because it is over-designed and too
cumbersome to use.
Think for a moment about the crypto systems that are in most widespread
use; SSL, WiFi, Kerberos, etc.
Every single one of the successful crypto systems had a major flaw, SSL
1.0 was deployed and then broken 15 minutes into the disclosure of the
algorithm. SSL 2.0 had major problems. But SSL 3.0 was fixed and is the
best tool we have deployed today.
WiFi is an even more on point example. The biggest problem with WEP is
not the security vulnerability, it's the fact that the spec is too
difficult for people to turn on and so less than 50% of access points
are encrypted.
I am not arguing for negligent design here, just some perspective. I
think that we need to think about what happens if ASCII art is used as
an attack on a large scale. The worst case scenario I can think of is
that everyone turns off nowsp and switches to simple.
Another possibility is that we develop a third C14N algorithm in the
group to supplement the existing two. Or maybe we modify checking of
nowsp to make it MIME aware in some degree or perhaps we think up
another fix.
The point is that we have to walk a fine line here. We should make the
scheme as robust as possible but we have to understand that if we
over-do it we risk a system that is too brittle. Its like
shove-ha'penny, you want to go as close to the edge as possible without
falling off the cliff.