🚀 go-pugleaf

In article <1992Oct6.192856.12630@csi.uottawa.ca> cbbrowne@csi.uottawa.ca (Christopher Browne) writes:
>...
>Many of the discussions that have gone under this subject line REALLY
>should fall under a subject like: "Key Transmission."
>
>And I think a good point has been brought up:
>
>For most of the people playing with PGP, the actual security of the
>system is really not ALL that important.
>
>If someone is REALLY interested in security, it is because there are
>two or more people that have some CRITICAL communications.  And
>...
>They'll dictate armour code numbers over the telephone if they have
>to; they'll more likely send a printout/disk containing the keys
>
>- It's FUN to feel that you get to "fool" sundry government agencies
>- It's FUN to try to figure out ways of breaking the system
>- It's FUN to try to figure out ways of strengthening the system

There are all sorts of uses for PGP and the various alternatives with 
less than perfect key verification and hence far less than perfect 
privacy/authentication. 

1. Mail is often misdirected unintentionally. Life is like that. Your 
sysadmin probably sees at least part of a message not intended for 
his/her eyes on a regular basis. Sometimes mail even ends up in the 
wrong mailbox. If it is encrypted, your privacy is probably not 
compromised. For instance, the day before yesterday, due to a bizarre 
system problem at one of our feed sites, my boss received a mail 
message directed to me (true story). These things happen. 

2. It is possible for more or less any determined knowledgable user 
on a unix system (for example) to read your mail. If it is encrypted 
he/she has one more hoop to jump through before he/she can read it. 

3. With some method of key verification (even finger!) you are a lot 
less likely to be taken in by a forgery. Of course, some god-like 
organisation, can spoof all your lines of communications. But if some 
country's government wants the information on your computer they can 
probably get it anyway. However, anyone with a little knowledge can 
forge E-mail and news articles at will. Most of us can't spoof all 
of the finger requests from system x to system y on the internet. Of 
course, your system software could be rewritten, your router might be 
grabbing packets and the CIA might be sitting outside your house 
grabbing all of the electromagnetic radiation from your computer 
monitor. 

People have said it here before. If you want perfect security for your 
communications, you are out of luck. However if you want a greater 
degree of privacy, PGP used with some, but not extraordinary care, 
will give you that. I'm personally not worried about the possibility 
of someone sitting outside of my home picking up the electromagnetic 
radiation from my computer screen. 

For the sake of an analogy. People put burglar alarms in their houses 
not to give them perfect security, but to make it more difficult to 
steal or damage their goods/homes. Anyone with sufficient skill, 
determination, and resources will probably be able to circumvent most 
alarm systems. Same thing with privacy enhanced email. 

Mark
-- 
Mark Henderson, SoftQuad Inc, 108-10070 King George Hwy, Surrey, B.C. V3T 2W4
Internet:   markh@wimsey.bc.ca, mch@sq.com
UUCP: {van-bc,sq}!sqwest!mch Telephone: +1 604 585 8394  Fax: +1 604 585 1926
RIPEM public key available by Email, finger markh@wimsey.bc.ca or keyserver