Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Re: pgp passphrase
From: Valdis.Kletnieks () vt edu
Date: Fri, 26 Mar 2004 18:14:47 -0500

On Fri, 26 Mar 2004 10:24:56 CST, Max Valdez <maxvalde () fis unam mx>  said:
That job is easy, the problem is that the revocation would happend really 
fast, so the key would be valid anymore.

Actually, the problem is that the revocation *won't* happen soon (if at all).

First the user has to *realize* there's a problem - this in a world where we're
*still* seeing MAGISTR, Klez, Sobig, and BugBear infected e-mail.

Then, the user has to get the key revoked.

Then finally, for PGP, the people verifying the signature have to go and
manually fetch the revoked key and get it on their keyring.  For S/MIME-style
PKI, you need to be using software that actually checks a CRL (very few things
do so by default).

Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]