RE: PGP flaw found by Czech firm allows dig sig to be forged

2001-03-24 Thread David Honig
At 08:38 PM 3/23/01 -0800, Ray Dillinger wrote: And finally, it would have to have some kind of tamperproof keyboard -- noplace to install hardware key loggers. What the world needs now is a membrane keyboard, used only for entering keys, which can be folded into a credit card and stored in

RE: PGP flaw found by Czech firm allows dig sig to be forged

2001-03-23 Thread Ray Dillinger
BO, trojans, http tunelling and similar are really not rocket science these days. 99% of sheeple machines are vulnerable. This is perfectly valid and real attack. Not on my machines and probably not on yours - that does not make any difference. This is just another data point supporting secure

RE: PGP flaw found by Czech firm allows dig sig to be forged

2001-03-22 Thread aluger
At Wed, 21 Mar 2001 23:01:56 -0500, "Phillip Hallam-Baker" [EMAIL PROTECTED] wrote: The report is incorrect in stating that PGP is the most popular email security package, there are 100 million copies of S/MIME enabled email applications in use. And how many of those "in use" applications

Re: PGP flaw found by Czech firm allows dig sig to be forged

2001-03-21 Thread lcs Mixmaster Remailer
Ian writes: Of course, if someone can modify your private keyring, I'd suspect your TCB is toast. (Unless you're in the habit of shipping your private keyring around the Internet.) For the interested, this is my guess at the attack. Modify the encrypted value of p, somewhere near the

RE: PGP flaw found by Czech firm allows dig sig to be forged

2001-03-21 Thread Phillip Hallam-Baker
What the flaw says is that if I get write access to your private key I can cause you to reveal it. Like interesting but not exactly gripping stuff. If I can write to your private key you are probably !@@$(**ed. The report is incorrect in stating that PGP is the most popular email security