On 04/07/2011 08:05 PM, Jan Janka wrote: > thanks for the answer, but it seems to me with this procedure you only > check whether the person has access to the email address, you > don't check whether this access is illegal, don't you?
I have made no claims anywhere about legality or illegality (i also
haven't specified legal jurisdiction, for that matter).
Do you mean "should legitimately have access", or something like that?
The verification test caff proposes is "Does the keyholder have the
ability to read mail sent to the address in the User ID?". This is
pretty close to what i want to know, actually.
It does not try to test things like "does the e-mail address in question
use a good passphrase for access" or "is it hosted on a reliable mail
host" or "are all steps of SMTP delivery STARTTLS-capable using X.509
certificates with sensible trust anchors" or "is legally-entitled to
under US law". These other tests are all rather subjective, potentially
impossible to automate, and of dubious usefulness anyway.
So i'm pretty happy with the caff methodology, though i'd be open to
hearing other concrete proposals that answer relatively clear-cut questions.
I do have some problems with the caff user interface, but that's another
story :/
Regards,
--dkg
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
