Re: Re: pgp passphrase

[Valdis.Kletnieks () vt edu]

On Fri, 26 Mar 2004 10:24:56 CST, Max Valdez <maxvalde () fis unam mx>  said:
> That job is easy, the problem is that the revocation would happend really 
> fast, so the key would be valid anymore.

Actually, the problem is that the revocation *won't* happen soon (if at all).

First the user has to *realize* there's a problem - this in a world where we're
*still* seeing MAGISTR, Klez, Sobig, and BugBear infected e-mail.

Then, the user has to get the key revoked.

Then finally, for PGP, the people verifying the signature have to go and
manually fetch the revoked key and get it on their keyring.  For S/MIME-style
PKI, you need to be using software that actually checks a CRL (very few things
do so by default).

Attachment: _bin
Description: