Using PGP on Insecure Machines

[tcmay@netcom.com (Timothy C. May)]

L. Todd Masco writes:

> In article <199408240440.VAA06740@netcom4.netcom.com>,
> Timothy C. May <tcmay@netcom.com> wrote:
> >Since this sysop or one of his cronies can then compromise your mail,
> >sign messages and contract as "you," I consider this totally
> >unacceptable. Others apparently don't.
> 
> Well... Either that, or they have their own UNIX boxes (an increasing
>  trend in this world of Linux boxes...) or other personal machines
>  that run an MTA and emacs.

Precisely! In fact, I think I cited the Linux phenomenon just a day or
so ago...(in a mention of cheap Pentium boxes). When many more
locally-controlled boxes are on the Net, conveniently, then things
should start to really get going.

Until the "Internet-in-a-box" or TIA-type products are more
widespread, many people will be connecting home or office machines to
other systems they don't control. (To put this in sharper focus: do
you want your electronic money being run out of an account that your
sysop and his friends can monitor? Not hardly. "Electronic purses,"
which may be smart cards, Newton-like PDAs, or dongle-like rings or
pendants, are clearly needed. Another entire discussion.)

Too many people are kidding themselves that their messages are secure.
That their electronic identities cannot be spoofed. Debate about
whether PGP needs 4096-bit keylengths is absurdly moot if PGP is being
run on a university or corporate computer outside the direct control
of the user!

Some folks who use PGP on such machines at least take steps to better
secure things....Perry Metzger, for example, once described the
multi-stage process he went through each day to reload his key
material in a way he felt was quasi-safe. 

Yes, some of you PGP fans may say "Sigh!" when you hear that I don't
particularly like downloading-and-then-decrypting a message only to
find it saying, "Gee, Tim, isn't this PGP stuff really neat?" Too bad.

Not only do many of us not do all this stuff (have you seen Eric
Hughes signing his messages? How about John Gilmore?), but some people
have decided to stop reading e-mail altogether. Donald Knuth, for
example. A wise man.

I'm happy that you PGP fans are thoroughly infatuated with using PGP
for everything. Just knock off the clucking and sighing about those
who don't see it as the end-all and be-all of today's communications.

It reeks of fanaticism.

--Tim May




-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."