On 3/11/2010 11:36 PM, erythrocyte wrote:
> On 3/12/2010 10:54 AM, Doug Barton wrote:
>> "Secure" in this context is a relative term. (Note, I'm a long time user
>> of pidgin+OTR and a longer-time user of PGP, so I'm actually familiar
>> with what you're proposing.) If you know the person you're IM'ing well
>> enough, you can do a pretty good job of validating their OTR
>> fingerprint. But how "secure" that is depends on your threat model. Are
>> you going to be encrypting sensitive financial data? Fruit cake recipes?
>> Blueprints for nuclear weapons? Is the security of your communication
>> something that you're wagering your life (or the lives of others) on?
>
>
> Hmmm...if I understand it correctly, if and when the OTR session is
> fully verified/authenticated it doesn't matter what the content of the
> data you transmit is. It could be any of the above - fruit cake recipes,
> financial data, et al.
You posited a scenario where you are using OTR communications to verify
a PGP key. My assumption (and pardon me if it was incorrect) was that
you had a security-related purpose in mind for the verified key.
Doug
--
... and that's just a little bit of history repeating.
-- Propellerheads
Improve the effectiveness of your Internet presence with
a domain name makeover! http://SupersetSolutions.com/
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
