[Full-disclosure] Mail Drives Security Considerations

[gabriel rosenkoetter]

On Fri, Nov 03, 2006 at 11:28:27AM -0500, Matthew Flaschen wrote:
> Why can't message signing offer backwards compatibility (assuming you
> use multipart/signed)?

Seems to me that adding a PGP signature verification to every
operation on files (even ls(1); you have to check to make sure it's
not a spoofed file) would rather noticeably impact the
performance of what's already got to be pretty slow on most users'
connections, and it adds a layer of complexity to the setup (you
have to generate the key pair, and have the private key available on
any system which you intend have write access) but that would certainly
work. Spam will still be a DoS against storage space, of course.

Never mind that this software violates gmail's acceptable use
policy and is transmitted back and forth in the clear (unless you
want to roll PGP encryption into the mix, in which case keeping
paths in the clear in the subject breaks the security), so it'd be
hard to view data stored this way as being "secure" to begin with...

-- 
gabriel rosenkoetter
gr at eclipsed.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20061105/669fedd5/attachment.bin