On Fri, 26 Mar 2004 10:24:56 CST, Max Valdez <maxvalde@xxxxxxxxxxx> said: > That job is easy, the problem is that the revocation would happend really > fast, so the key would be valid anymore. Actually, the problem is that the revocation *won't* happen soon (if at all). First the user has to *realize* there's a problem - this in a world where we're *still* seeing MAGISTR, Klez, Sobig, and BugBear infected e-mail. Then, the user has to get the key revoked. Then finally, for PGP, the people verifying the signature have to go and manually fetch the revoked key and get it on their keyring. For S/MIME-style PKI, you need to be using software that actually checks a CRL (very few things do so by default).
Attachment:
pgp00141.pgp
Description: PGP signature