Re: trust your corporation for keyowner identification?

2013-10-22 Thread Stan Tobias
"Robert J. Hansen" wrote: > > In my proposed scenario, the corporation is doing nothing more than > > providing a means for the participants to know that Bob is actually Bob > > because the company has checked his id and said he is and providing an > > authenticated means (again, IT being a black

Re: trust your corporation for keyowner identification?

2013-10-23 Thread Stan Tobias
"Robert J. Hansen" wrote: > On 10/22/2013 11:01 AM, Stan Tobias wrote: > > But this is not a real identification - almost none of us > > has means to confirm an identity, which is a job for a detective. [...] > As far as the U.S. Marshal was concerned, my ide

Re: trust your corporation for keyowner identification?

2013-10-23 Thread Stan Tobias
Peter Lebbing wrote: > On 23/10/13 19:26, Stan Tobias wrote: > > The paradox is removed when we realize that the notary's signature is > > not a statement about the identity of the person. > > I strongly disagree. The paradox is created by the fact that you screw >

Re: trust your corporation for keyowner identification?

2013-10-24 Thread Stan Tobias
Peter Lebbing wrote: > On 24/10/13 01:15, Stan Tobias wrote: > > , then why do we believe WoT authenticates anything? Why do we accept, for > > example, a conversation by telephone to validate a key fingerprint? > > Because these are verifications outside the Web of Tru

Re: trust your corporation for keyowner identification?

2013-10-28 Thread Stan Tobias
Peter Lebbing wrote: > On 24/10/13 01:15, Stan Tobias wrote: > > No, there's no paradox. Any liar will screw your parameters. > > The paradox was very clear in my post where I still called it a dichotomy. > There > was a paradox in my thoughts and conclusions, why d

Re: gpgsm and expired certificates

2013-11-02 Thread Stan Tobias
are a different kind, they often work for you against general policies, if you can interpret signs correctly and cooperate. Kindly, Stan Tobias. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Quotes from GPG users

2013-11-02 Thread Stan Tobias
On 30/10/13 11:58, Sam Tuke wrote: > I'm working with Werner to promote GnuPG and raise awareness. To that end > we're > collecting quotes from users - endorsements from people who know and trust > GPG, > people like you. > > If you want to help us, send your own statement about why GPG is impor

Re: trust your corporation for keyowner identification?

2013-11-10 Thread Stan Tobias
"Paul R. Ramer" wrote: > Stan Tobias wrote: > >Yes, but by remote communication. The reasoning goes like this: The > >signature is validated by my certificate (or, in case 2a, by my > >friends' > >whom I trust fully). The message is authenticated b

Re: trust your corporation for keyowner identification?

2013-11-10 Thread Stan Tobias
r signature on the second key that you have > *verified* it. Nothing more, nothing less. If you didn't follow all of > the steps to verify it, why would you sign it with an exportable > signature? You verify the key(s) by inspecting them and drawing conclusions. You have

Re: Can't enter passphrase in su session.

2009-05-24 Thread Stan Tobias
mike _ wrote: > So maybe the problem is that under su, gpg-agent fails to launch > /usr/bin/pinentry (which in turn decides whether to launch > pinentry-curses, or a QT or GTK equivalent). If I run gpg under strace > and look through the output there is no mention of /usr/bin/pinentry > being cal

Re: what is killing PKI?

2012-08-25 Thread Stan Tobias
As this thread is turning into a general discussion on privacy and encryption, I would like just to add one more to the garden of thoughts. I'm not making any argument for or against, I just want to say some people find (forced) privacy detrimental, especially in a broad social context. Faramir w

Re: what is killing PKI?

2012-08-26 Thread Stan Tobias
ion is being applied to a social problem. Faramir wrote: > El 25-08-2012 10:33, Stan Tobias escribió: > > Faramir wrote: > >> IMHO, the main trouble probably is people don't feel the need to > >> protect their privacy. If they don't feel that need, why sho

Re: what is killing PKI?

2012-08-28 Thread Stan Tobias
For the lack of time, I'll be very brief. I plan to answer Robert Hansen's post, but I yet need to find a couple of free hours for that. Faramir wrote: > What would happen if you start reading your daughter's diary > everyday, but never let anybody catch you reading it? And you are > careful

Re: what is killing PKI?

2012-08-28 Thread Stan Tobias
For lack of time, I have to be brief; I just answer the most important points. "Mark H. Wood" wrote: > I use encryption to enforce the privacy I already (should) have. I answered this in my post to Faramir, several minutes ago. > So, yes, it's a weapon. I call it a weapon, because it does

Re: what is killing PKI?

2012-08-29 Thread Stan Tobias
"Stan Tobias" wrote: > but generally people > don't like to be excluded, people want everyone to be open. What I should have added here, is that it's a symmetric relation, and people normally don't like to exclude others, as well. Avoiding others is not a trai

Re: what is killing PKI?

2012-08-30 Thread Stan Tobias
MFPA wrote: > > What I should have added here, is that it's a symmetric > > relation, and people normally don't like to exclude > > others, as well. Avoiding others is not a trait of > > _usual_ _social_ behaviour, > > There are innumerable clubs that require membership in order to > participate

Re: what is killing PKI?

2012-08-30 Thread Stan Tobias
Faramir wrote: > El 28-08-2012 18:27, Stan Tobias escribió: > Right, that was my point. From your previous message, I got the idea > you suggested if we want to use buses, we must use them, if we want > privacy, we must send clear text messages and claim "don't read >

Re: what is killing PKI?

2012-10-03 Thread Stan Tobias
to do. Now, what are _you_ up to?". Secrecy would probably be not adequate, because then police could use any pretense to enter the offices to hamper the activity. Transparency also helps keep internal discipline (don't do stupid things). "Robert J. Hansen" wrote: &g

Re: gpg for pseudonymous users [was: Re: gpg for anonymous users - Alternative to the web of trust?]

2013-04-05 Thread Stan Tobias
Daniel Kahn Gillmor wrote: > I've changed the subject line to indicate that this thread is about > establishing a pseudonym, *not* about anonymous users. This is a subtle > but important difference. People assume pseudonyms for various reasons, anonymity being but one of them. It is clear the

Re: gpg for pseudonymous users [was: Re: gpg for anonymous users - Alternative to the web of trust?]

2013-04-07 Thread Stan Tobias
Daniel Kahn Gillmor wrote: > On 04/05/2013 11:39 AM, Stan Tobias wrote: > > Daniel Kahn Gillmor wrote: > > >> For a pseudonymous author who wants to establish a credible claim to a > >> given identity, one way would be to encourage the people who have been > >

Re: gpg for pseudonymous users

2013-04-14 Thread Stan Tobias
Daniel Kahn Gillmor wrote: > On 04/07/2013 04:06 AM, Stan Tobias wrote: > > > I'd be willing, too, to sign the Enemy's key, as long as its UID says > > "Enemy" and not "Friend". [...] > If you want to make a statement about whether someone

Re: How trust works in gpg...

2008-04-15 Thread Stan Tobias
private key, which is connected to UID1, which I trust belongs to the person it says it belongs to. So the only person that could have added UID2 is the one that is in control of UID1 (supposedly, it's the same person). Why is there a need to check anything? Stan Tobias [ Apologies to Pe