PGP signatures.

Tim ignored_mailbox at yahoo.com.au
Sun Jun 1 07:42:56 UTC 2008


On Sat, 2008-05-31 at 10:59 -0700, Les wrote:
> Simply put, one could create a keylist, publish it someplace secure
> with limited access and limited time availability, communicate to the
> designated individual where and when, and the designated individual
> could use something like VPN to pick up the encrypted key list.  The
> key to break that key list could be given over the phone.  The result
> would certainly minimize exposure of the keys.  

I'm not sure that exposure of keys is a problem (so long as keys are
strong).  I'd be unconcerned about exposure of uncrackable keys if keys
and key IDs were used, with no way to harvest email addresses from them.
i.e. If keys didn't contain addresses, just unique IDs.

I've seen systems which try and make this easier for users, they do all
the key handling externally.  Unfortunately, that means that your
private key is held externally, and your passphrase to use it has to be
transmitted.  Some of the turn-key virtual webhosting systems work that
way, e.g. CPanel.  Worse still, users typically access their control
panel over HTTP, not HTTPS.

-- 
[tim at localhost ~]$ uname -r
2.6.25.3-18.fc9.i686

Don't send private replies to my address, the mailbox is ignored.  I
read messages from the public lists.






More information about the fedora-list mailing list