Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Mike Easter Newsgroups: alt.os.linux Subject: Re: Marek Novotny Verification Date: Sun, 25 Sep 2016 05:56:01 -0700 Lines: 37 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net nf1VHPnQCC61IrxkCbfelAp+9z3SumMF3uMhPcfC9A0G5jqv4x Cancel-Lock: sha1:tYWxtBjz7vTFcuKr/FyXnPCx2gE= User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 In-Reply-To: Xref: csiph.com alt.os.linux:39179 Marek Novotny wrote: > Do you see value in adding GnuPG signatures to your posts? Or is it > overkill? For the purposes of what we are talking about, clearsigning does not solve the problem because of what you say below. > If the guy reading the post isn't setup for verification then it > seems moot to me. Thoughts? That is correct. The true power of clearsigning involves a web of trust process for the public key and the involvement of those who would verify your clearsign into the scheme of verification. IMO clearsigning in newsgroups should be limited to newsgroups in which people are practicing the use of such tools, such as alt.security.pgp. In the case of newsgroup spoofs and forgeries, other strategies can be employed if necessary. The strategy depending on how 'aggressive' the adversary is. This GG example is trivial. For newsgroups, if you are choosing to use/expose an email address which belongs to you, 'legitimate' news servers which enforce policies against forgeries will act against those who would use their servers to forget you. The email address doesn't solve all of the problems; some people don't want to expose a good email address other limitations. Another strategy is to use a news server which stamps your nntp posting host, such as sunsite.dk/dotsrc.org -- Mike Easter