Need help understanding the difference between assigning owner trust and key validity.

2009-06-12 Thread Steven W. Orr
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 There's a pgp concept that I'm not comfortable with. It has to do with the difference between owner trust and key validity. And I say comfortable, not because I don't like it or that I don't think it doesn't work; I just don't feel like I understand it

Re: Security Concern: Unsigned Windows Executable

2009-06-12 Thread Robert J. Hansen
John Clizbe wrote: > Maybe it has something to do with requiring use of a proprietary > Microsoft SDK? The signcode.exe tool is proprietary, but it does not depend on the code being produced by a proprietary compiler. IIRC, that is: it's been a while. __

Re: Security Concern: Unsigned Windows Executable

2009-06-12 Thread John Clizbe
Doug Bateman wrote: > Here's an interesting question why does GnuPG.org bother providing a > GPG signature with it's downloaded files? To check the integrity and authenticity of the downloaded file? Not everyone is bootstrapping GnuPG onto a new machine or even using Windows. > So this raises

Re: Security Concern: Unsigned Windows Executable

2009-06-12 Thread Doug Bateman
Here's an interesting question why does GnuPG.org bother providing a GPG signature with it's downloaded files? I can guess at several possible reasons other than MitM attacks: (a) To allow users to ensure mirrored copies are legit, (b) To safeguard against tampering with the file on the downlo

Re: Security Concern: Unsigned Windows Executable

2009-06-12 Thread reynt0
On Tue, 9 Jun 2009 gpg2.20.mani...@dfgh.net wrote: . . . *some practical questions with the above as given * - Would It help if I had two networks to connect to ...say the home one and the office one ? . . . Phrasing my answer now in terms related to the original question starting this threa

Re: Smartphone platforms andd gnupg

2009-06-12 Thread John W. Moore III
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 James P. Howard, II wrote: > There's an implementation for BlackBerry called AtomicHelix > (www.atomichelix.com). I tried it and it does encryption/decryption > reasonably well, but there is no support for signing or verifying messages. There is al

Re: Smartphone platforms andd gnupg

2009-06-12 Thread James P. Howard, II
There's an implementation for BlackBerry called AtomicHelix (www.atomichelix.com). I tried it and it does encryption/decryption reasonably well, but there is no support for signing or verifying messages. James Original Message From:Werner Koch Date:Fri Jun 12 2009 05:

Re: Smartphone platforms andd gnupg

2009-06-12 Thread Werner Koch
On Fri, 12 Jun 2009 00:02, malte.g...@gmx.de said: > I think bringing things like Phil Zimmermann's Zphone to a smartphone would > make more sense. A free, encrypting voice over ip tool, wouldn't that make > more sense on a phone? In fact, we have a free ZRTP implementaion for quite some time:

Re: Smartphone platforms andd gnupg

2009-06-12 Thread Johannes Graumann
Malte Gell wrote: > > Johannes Graumann wrote > >> Is there any of the common smart phone platforms (Symbian, Windows CE, >> OSX, Android, ...) that enables painless integration of gnupg? For >> android I'm not even sure yet whether a mail client for anything but >> gmail exists, but in general: