On Fri, Nov 03, 2006 at 11:28:27AM -0500, Matthew Flaschen wrote: > Why can't message signing offer backwards compatibility (assuming you > use multipart/signed)? Seems to me that adding a PGP signature verification to every operation on files (even ls(1); you have to check to make sure it's not a spoofed file) would rather noticeably impact the performance of what's already got to be pretty slow on most users' connections, and it adds a layer of complexity to the setup (you have to generate the key pair, and have the private key available on any system which you intend have write access) but that would certainly work. Spam will still be a DoS against storage space, of course. Never mind that this software violates gmail's acceptable use policy and is transmitted back and forth in the clear (unless you want to roll PGP encryption into the mix, in which case keeping paths in the clear in the subject breaks the security), so it'd be hard to view data stored this way as being "secure" to begin with... -- gabriel rosenkoetter gr@xxxxxxxxxxxx
Attachment:
pgpMK9SwTfemN.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/