lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <200403262314.i2QNElIk026422@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Re: pgp passphrase 

On Fri, 26 Mar 2004 10:24:56 CST, Max Valdez <maxvalde@....unam.mx>  said:
> That job is easy, the problem is that the revocation would happend really 
> fast, so the key would be valid anymore.

Actually, the problem is that the revocation *won't* happen soon (if at all).

First the user has to *realize* there's a problem - this in a world where we're
*still* seeing MAGISTR, Klez, Sobig, and BugBear infected e-mail.

Then, the user has to get the key revoked.

Then finally, for PGP, the people verifying the signature have to go and
manually fetch the revoked key and get it on their keyring.  For S/MIME-style
PKI, you need to be using software that actually checks a CRL (very few things
do so by default).

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040326/38a2f8aa/attachment.bin

Powered by blists - more mailing lists