> On 14 Jan 2016, at 21:26, Peter Lebbing <pe...@digitalbrains.com> wrote: > please don't phrase your words as fact when it's such a contended issue.
Fair enough, let me rephrase: I don't believe it's a long term solution, particularly as the capabilities of well-funded attackers to mitm multiple network paths simultaneously appear to be still growing. But yes, in many cases it is good enough to be getting on with. >> Tofu does not guarantee identity persistence. Just because your >> correspondence hasn't been obviously tampered with (yet) does not mean >> that someone hasn't been MITMing you all along and biding their time. > > Isn't "MITM'ing all along" identity persistence then? It's quite unfortunate > it's the /wrong/ identity, but it's identity persistence in my book, No, because mitm doesn't mean one identity replaces another, but that the two identities become conflated. A signature that could have been created by one of two people does not identify either person. If I faithfully transcribe every email that I mitm apart from one, it does not make me the author of the faithful mails; only of the one that I alter. A _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
