full-disclosure - Re: pgp passphrase

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200403262314.i2QNElIk026422@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Re: pgp passphrase 

On Fri, 26 Mar 2004 10:24:56 CST, Max Valdez <maxvalde@....unam.mx>  said:
> That job is easy, the problem is that the revocation would happend really 
> fast, so the key would be valid anymore.

Actually, the problem is that the revocation *won't* happen soon (if at all).

First the user has to *realize* there's a problem - this in a world where we're
*still* seeing MAGISTR, Klez, Sobig, and BugBear infected e-mail.

Then, the user has to get the key revoked.

Then finally, for PGP, the people verifying the signature have to go and
manually fetch the revoked key and get it on their keyring.  For S/MIME-style
PKI, you need to be using software that actually checks a CRL (very few things
do so by default).

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040326/38a2f8aa/attachment.bin