--- Tad Marko <[EMAIL PROTECTED]> wrote:
> > You can't. That's like asking how you can stop
> other people from
> > printing out badges that say "I am Tad Marko" and
> pinning them to their
> > shirts.
>
> I'm not asking for that. I want them to not say that
> a given key goes
> to [EMAIL PROTECTED]
>
> > Besides, if you could do that, what would stop
> someone else from
> > deleting YOUR key off of the keyserver or flagging
> THEIR key as the real
> > Tad Marko?
>
> An email verification step?
The problem is, that IF the email infrastructure was
secure enough to be trusted, there would be no need
for pgp/gpg/smime at all. An email verification step
is not, and cannot be, 100% secure.
Of course, in many cases, email is not re-routed,
server admins can be trusted, email systems are not
broken in to - to the extent that email without
additional security is largely trusted as "good
enough".
But, in fact, if someone is willing to forge a key
with your name on, it is probably one of those times
that email may well not be "good enough". Hence the
need to rely on key fingerprints, not on the email
system.
Best,
Nicholas
___________________________________________________________
To help you stay safe and secure online, we've developed the all new Yahoo!
Security Centre. http://uk.security.yahoo.com
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
