full-disclosure - iDEFENSE: Upcoming OpenSSH Security Advisory Anno Johnson)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <fb8688074a3e7714d03d222e7a131f4a@tatooine.homelinux.net>
From: nobody at tatooine.homelinux.net (starwars)
Subject: iDEFENSE: Upcoming OpenSSH Security Advisory Anno	 Johnson)

At 02:04 PM 5/3/2004 -0400, Michael Sutton wrote:
>
>
>*** PGP Signature Status: good
>*** Signer: Michael Sutton <msutton@...fense.com> (Invalid)
>*** Signed: 5/3/2004 2:04:14 PM
>*** Verified: 5/3/2004 4:18:14 PM
>*** BEGIN PGP VERIFIED MESSAGE ***

It would be nice if this was message had been signed with a key that had someone else's signatures on the public key. I mean, at least it's self-signed, but can't you iDefense guys manage to sign each other's keys? Any moron could generate a key with your ID and self-sign it.

This isn't the first iDefense spoof.  When are you going to take non-repudiation more seriously?