Two-person approval email system

Question

I'm currently in a position where there are two of us, and neither of us should be able to send an email from a joint account without the explicit approval of both of us. Ideally, I'm looking for software which will basically allow either of us to compose an email, and then hold it until both of us have clicked a "Send" button. The obvious generic extension of this which has a slightly likelier chance of existing would require m approvals from a total of n people.

In particular, we are looking for an automated solution to ensure that neither of us accidentally thinks that the other has given implicit approval (say verbally) when in fact that hasn't happened. The attack vector of one of us forging an SMTP header is not one that we are trying to defeat.

Answer 1

My first thought is to have a python server task running that allows either/any you to compose an email, GPG signs it and displays it for the other(s) to approve & possibly edit - editing should invalidate any GPG signatures - and it sends when the required number of valid signatures are reached. Python includes an SMTP module in the standard libraries and a GPG wrapper is available for the signing/checking functionality.

This should be reasonably easy to implement and you have a wide choice of user interface libraries. Definitely cross platform and free as GPG and python are both FOSS and available for a wide range of platforms.

Of course you could just tailor your signatures to read something like "This email only acts as permission to proceed if it has been GPG signed by both...." and use a standard GPG email plugin.

Answer 2

This is possible in GNU Mailman 2.1, and probably plenty of other mailing list tools. It can be accomplished by marking one of you as a non-member whose messages are moderated and the other as a list moderator.

The key settings in Mailman 2.1 are these:

• default_member_moderation=YES
• member_moderation_action=REJECT
• generic_nonmember_action=REJECT
• hold_these_nonmembers[email protected]
• moderator[email protected]

Note that [email protected] should not be a member of the mailing list. Also note that in this setup, neither of you needs to be the list administrator, so you can set it up so that neither of you can override these settings. (Moderator != List administrator.)

This isn't quite what you want, in that it forces the order of approval. In other words, Person A must always send, then Person B must always approve, and never the other way around. However, I think it is close enough.

See additional Mailman 2.x documentation, and Mailman 3.x documentation. The new Mailman Postorius web interface doesn't seem to have much documentation yet.