eugen leitl eugenleitlorg begin pgp signed message hash sha1 sun 11 aug 2002 gordon mohr wrote users dont like entering passphrases sending email usb fobs smart cards removable hardware yet widespread bad assumption really code sign stuff without aware pretty much invalidates already tenuous since assumes trusting contents frame buffer concept digital signature secure piece hardware puts keyring outside codes reach key never leaves hardware compartment mechanically acknowledge signing process cryto fob falls back default state locked reasonable ui would enter passphrase time launch mail program never per day sometimes per week im pretty comfortable entering passphrase every time production key usually access home box via ssh session ssh sessions easily attackable model typing pattern dont expect announce plutonium shipments via medium myy workstations id even happy necessary signing key cached disk signing automatic hit send spammer code read local hard disk bigger problems spoofed spam agree nevertheless number people use cryptography machines compromised eugen leitl leitl ______________________________________________________________ icbmto n48 04148 e11 36412 httpleitlorg 83e5ca02 ede4 7193 0833 a96b 07a7 1a88 aa58 0e89 83e5 ca02 begin pgp signature version gnupg v106 gnulinux comment info see httpwwwgnupgorg id8dbqe9vtlfqlgoiyplygiralrgaj9mbpmjqesiqxd0g43avgslfcessqcepf8x smdzfndb40mbqmv0l3yzmoy acss end pgp signature httpxentcommailmanlistinfofork sun 11 aug 2002 231025 0200 cest forged whitelist spam