🚀 go-pugleaf

Well, now you've said it three times slowly and loudly I think I'm
begining to get the point!

How does this analysis sound to you?

   - The only person who can verify my key with reasonable certainty is
me.  (Leaving aside the real paranoiacs in the other thread talking
about PGP having been spoofed).

   - The other element in the system that needs verification is the
communications path between me and the net.

   - So, if I have access to more than one route I can test my local
mail system by sending a copy of my key from one of my mailboxes to
another and comparing.  (The userids on the different systems are
different so are spoofer doesn't know what I'm about).

   What can I tell you?

   - "My mail system is verified. Use it with confidence"?  This message
can be spoofed but to what end?  If the spoofer isn't substituting my
key then he hasn't gained anything and if she is then I know and she
gains nothing but a sex change.

   - "My mail system is compromised.  Do not talk to me."  We now have
the same security as the write-only file (called "NULL:" on dos
systems).  But I presume I can take measures - sue the network
administrator for negligence or something.

   If this works can I extend it to users with only one net link: you
send me your key (ASCII format) and I print it and post it to you?  Then
somebody steams the envelope open!!

   Any good?

Richard

[ "Hey baby, you should be in real life!" - Zaphod Beelblebrox I ]