Re: reflecting on PGP, keyservers, and the Web of Trust

[Steven M. Bellovin]

In message <[EMAIL PROTECTED]>, Dan Geer writes:
>
>>   How do they exchange public keys?  Via email I'll bet.
>
>Note that it is trivial(*) to construct a self-decrypting
>archive and mail it in the form of an attachment.  The
>recipient will merely have to know the passphrase.  If
>transit confidentiality is your aim and old versions 
>of documents are irrelevant once the ink is dry on the
>proverbial bond paper, this is quite workable and involves
>no WoT at all, just POTS.

No!  We've discussed this point many times before -- what if the 
attacker sends a Trojan horse executable?

                --Steve Bellovin