Re: PGP/MIME considered harmful for mobile

2011-03-02 Thread Ben McGinnes
On 3/03/11 3:17 PM, David Shaw wrote: > > The premise (more or less) was that a guy named Martin (RM) was on a > mailing list and signed all his mail. After some time, a new guy > (FM) shows up and claims that he is, in fact, Martin. FM may have > his own key or may not have a key at all. It do

Re: PGP/MIME considered harmful for mobile

2011-03-02 Thread David Shaw
On Mar 2, 2011, at 10:04 PM, Ben McGinnes wrote: > On 1/03/11 9:33 AM, David Shaw wrote: >> >> That experiment, while interesting, is not relevant to the "real >> Martin" / "fake Martin" situation we've been talking about. If both >> Real Martin and Fake Martin have the same secret key, then the

Re: PGP/MIME considered harmful for mobile

2011-03-02 Thread Ben McGinnes
On 2/03/11 8:20 AM, Ingo Klöcker wrote: > > Of course, my experience is from a time when UTF-8 wasn't used in email. > But do the standard mail clients (Outlook, GMail, Thunderbird) really > default to UTF-8 nowadays? Expecting people to properly configure their > mail clients is an unrealistic

Re: PGP/MIME considered harmful for mobile

2011-03-02 Thread Ben McGinnes
On 1/03/11 9:33 AM, David Shaw wrote: > > That experiment, while interesting, is not relevant to the "real > Martin" / "fake Martin" situation we've been talking about. If both > Real Martin and Fake Martin have the same secret key, then there is > no way to tell them apart using signatures. Han

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Wednesday 2 March 2011 at 8:14:08 PM, in , Daniel Kahn Gillmor wrote: > it sounds to me like you've simply made it difficult > for people to correspond with you over long periods of > time because your e-mail address isn't likely to > conti

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread Robert J. Hansen
On 3/2/11 7:37 PM, Ben McGinnes wrote: > More seriously, I've been through this discussion with MFPA before and > I can see some circumstances where his idea might have merit, so I'd > be willing to help test too. Same here. I am deeply skeptical, but not unwilling to be proven wrong. IMPOSSIBLE

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread Ben McGinnes
On 1/03/11 1:20 PM, Grant Olson wrote: > > I wouldn't mind testing to help out, but I'm not throwing away my > current key anytime soon. Ah ha! Another hint about the scav hunt. ;) More seriously, I've been through this discussion with MFPA before and I can see some circumstances where his ide

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread Robert J. Hansen
On 3/2/11 6:34 PM, MFPA wrote: > You are going off at a tangent. The mechanism for preventing the phone > number being obtainable from a query of the phone book or directory > enquiry services is not relevant; just the fact that it can easily be > done. It's not a tangent at all, and for almost th

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Wednesday 2 March 2011 at 8:27:50 PM, in , Robert J. Hansen wrote: > The analogy continues to break down. "Binding," in the > context of the analogy, means "if someone breaks this > instruction, they will be hurt." Maybe the government >

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread Robert J. Hansen
On 3/2/11 2:25 PM, MFPA wrote: > Once, maybe. But for quite a few years (in the UK at least) there have > been many competing directory enquiries services, and more recently > the online versions as well. Choosing to be ex-directory is a > binding instruction to your telephone company not to releas

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread Daniel Kahn Gillmor
On 03/02/2011 02:25 PM, MFPA wrote: > For somebody who uses the same email address to communicate with many > contacts and keeps the same email address for a long time, that is > true. For somebody like me who uses various different email addresses > and replaces some of them on a regular basis it

Re: Enquiries about GnuPG

2011-03-02 Thread Robert J. Hansen
> 1. the functionality of the software It implements RFC4880. All MUST functions, as well as the overwhelming majority of SHOULDs (perhaps all!), are supported. > 2. the licensing structure(s) of the software and > associated prices for licensing GNU GPL v3. How much it costs depends on from w

Re: hashed user IDs [was: Re: Security of the gpg private keyring?]

2011-03-02 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Wednesday 2 March 2011 at 4:07:19 AM, in , Robert J. Hansen wrote: >> The benefits of your phone number being ex-directory >> are the benefits that derive from it being harder for >> people to obtain your phone number without your >> permis

Re: Enquiries about GnuPG

2011-03-02 Thread Doug Barton
You can find most (if not all) of the answers you're looking for at http://gnupg.org/ After reading the material there if you still have questions, fire away. Doug On 03/02/2011 06:56, Mizana ;) wrote: /*Dear Sir / Madame */ /*Good-day. I am enquiring further about the GnuGP Encryption Soft

Enquiries about GnuPG

2011-03-02 Thread Mizana ;)
  Dear Sir / Madame     Good-day. I am enquiring further about the GnuGP Encryption Software. I hope you are can assist.   I am interested to learn about: 1.    the functionality of the software 2.    the licensing structure(s) of the software and associated prices for licensing