Re: [gentoo-user] Mailing list and PGP/MIME

[Matt Harrison]

Mick wrote:
>  On Monday 26 May 2008, Daniel Iliev wrote:
> > On Sun, 25 May 2008 20:04:29 +0200
> >
> > Wolf Canis <wolf.canis@××××××××××.com> wrote:
> >> Mick wrote:
>
> >>> There are other lists however, when
> >>> it is not that rare for malicious (or unhinged) individuals to
> >>> impersonate someone else and hijack their email address to publish
> >>> offensive content. After a while using a digital signature (GnuPG
> >>> or x509) becomes a habit.
> >> That's exactly the case. ;-)
> > Two questions.
> > How would signing your emails to this list help you:
> >   - in avoiding the above to happen to you?
> >   - help you in case that happens after all?
> >
> >
> > Explain, please.
>
>  The reason I have given above does not apply as much to this list (so
far). 
>  In any case, the principle is that unless I have signed this message you
>  cannot be sure that it was authored/sent by me and as a matter of
course you
>  should assume that it was sent by someone else.  You can then
trust/distrust
>  the content of the message and the potential impact of any advice
offered in
>  it accordingly.
>
>  As far as this list is concerned singed messages don't cause any
harm.  Once
>  you set your client to sign messages, that's what it does . . .
>
Just a word of caution:

You can never fully trust even a signed message unless you have 
physically met the person in question and they have given you their key 
signature on some secure media such as a floppy disk. Downloaded keys 
from keyservers are not a guarantee that the key was made my the person 
in question. Unless I know the person well and they have provided means 
of verifying the key, I would only ever award marginal trust.

-- 
gentoo-user@l.g.o mailing list