🚀 go-pugleaf

mazz@faceng.newcastle.edu.au (Richard Mazzaferri) writes:
>dallet@ozemail.com.au (Michael Wines) wrote:
>> ryan@zip.com.au (Patrick Ryan) wrote:
>> 
>> >6. Perpertrators can fake their mail addresses making it next to
>> >impossible to prove that a person sent the offending transmission.
>> 
>> Oddly enough this is the reason the Senate Committee into
>> Internet Censorship suggested mandating strong encryption -
>> to make it mandatory to create encrypted digital signatures
>> on all messages, so that people couldn't hide their
>> identities.

>Won't "they" just start using fake digital signatures?  What's to stop
>someone creating a new public/private key pair and using that to provide a
>"signature", or faking the signature data itself?  

There was something in one of last weeks papers (I've forgotten which one,
but either AFR, The Australian or PC Week) about Australia Post wanting to
set them themselves up as a key signing authority, requiring the standard
100 points of identification used by banks. So you'd be able to create as
many key pairs as you want, but probably only get one signed.

I dont see how they could then force everybody to sign their email and
other net correspondence, but I'm sure they could come up with inventive
half-brained scheme :)

I can forsee major problems with this Australia Post key signing stuff.
Most people aren't savvy enough to protect their keys properly which is
going to create great opportunities for fraud. Mind you, I have nothing
against this Australia Post scheme in general, as long as it isnt
mandatory. It will be good to see some key signing authorities pop up. Just
what we need to help spread the use of encryption.

-- 
Cameron Hutchison (camh@zip.com.au) | Beware of the clams
GCS d--@ -p+ c++(++++) l++ u+ e+ m+(-) s n- h++ f? !g w+ t r+