Re: Re: Exposing email addresses on key servers

2009-06-28 Thread Sven Radde
Hi! Jesse Cheung schrieb: >> You can also use a freeform UID, which contains name and comment, but >> leave the email field empty. > Yeah I found it a good idea! There is, however, a drawback to this (which is why an email address is required by default)... Most (email-)clients will do automati

Re: Manual verification of PGP-Mime signatures

2009-06-28 Thread Werner Koch
On Fri, 26 Jun 2009 15:36, bmea...@ieee.org said: > through RFC 3156, but I'm still getting BAD signatures. I've tried > verifying a couple of different signatures from various lists, and the > example given in the RFC, but they all fail. I'm not sure what I'm Recall that the LF *before* a MIME b

Re: Exposing email addresses on key servers

2009-06-28 Thread Werner Koch
On Sun, 28 Jun 2009 07:20, jesse200808+gpg-us...@gmail.com said: > Yeah I found it a good idea! BTW it seems the file format doesn't > really stop us from putting invalid email address in the UID, so is Before doing so, you should evaluate whether it is still worth the trouble. Without an email

Re: Any UNIX API for GPG available?

2009-06-28 Thread Werner Koch
On Fri, 26 Jun 2009 14:46, mearn...@gmail.com said: > Perhaps inelegant was a little off the mark: how about inefficient? It is not inefficient in most cases. Public key crypto or crypting large amounts of data takes its time and thus the overhead of fork/exec is barely noticeable. Checking a l

Re: Exposing email addresses on key servers

2009-06-28 Thread Jesse Cheung
On Sun, Jun 28, 2009 at 7:43 PM, Werner Koch wrote: >> Yeah I found it a good idea! BTW it seems the file format doesn't >> really stop us from putting invalid email address in the UID, so is > > Before doing so, you should evaluate whether it is still worth the > trouble.  Without an email address

Re: Exposing email addresses on key servers

2009-06-28 Thread Werner Koch
On Sun, 28 Jun 2009 20:20, jesse200808+gpg-us...@gmail.com said: > Does it count if I put a human-readable address like johndoe AT > example DOT org? I know it (in such a form) is still fairly easy to > parse, but it's at least not as straightforward Right, any mail program must implement such a

New Revocation Certificate...

2009-06-28 Thread Jean-David Beyer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 If I add a subkey to my key (e.g., because the previous one expired), do I have to generate a new revocation certificate, or is the old one still good? I may never need to know the answer, but better before than after the compromise of a key. - -- ~

Re: New Revocation Certificate...

2009-06-28 Thread Daniel Kahn Gillmor
On 06/28/2009 04:44 PM, Jean-David Beyer wrote: > If I add a subkey to my key (e.g., because the previous one expired), do I > have to generate a new revocation certificate, or is the old one still > good? I'm assuming you're asking about the revocation certificate for your your entire GnuPG-gener

Re: New Revocation Certificate...

2009-06-28 Thread Jean-David Beyer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel Kahn Gillmor wrote: | On 06/28/2009 04:44 PM, Jean-David Beyer wrote: |> If I add a subkey to my key (e.g., because the previous one expired), do I |> have to generate a new revocation certificate, or is the old one still |> good? | | I'm assum

Re: Exposing email addresses on key servers

2009-06-28 Thread Brad Rogers
On Sun, 28 Jun 2009 21:09:41 +0200 Werner Koch wrote: Hello Werner, > mails with at lest one html part to the bitbucket. It always puzzles me why banking organisations send html email pointing out that "we all need to be security conscious" since html is so easily exploited for nefarious ends.

Re: Exposing email addresses on key servers

2009-06-28 Thread Robert J. Hansen
Brad Rogers wrote: > It always puzzles me why banking organisations send html email pointing > out that "we all need to be security conscious" since html is so easily > exploited for nefarious ends. Because the bank is concerned about the bank's security, not yours. The bank exposes itself to no

Re: Exposing email addresses on key servers

2009-06-28 Thread Jesse Cheung
On Mon, Jun 29, 2009 at 3:09 AM, Werner Koch wrote: > On Sun, 28 Jun 2009 20:20, jesse200808+gpg-us...@gmail.com said: > >> Does it count if I put a human-readable address like johndoe AT >> example DOT org? I know it (in such a form) is still fairly easy to >> parse, but it's at least not as strai