On 05/29/2013 01:28 PM, Johan Wevers wrote: [re: startssl]
> Further they deliver the private key to you, so they have access to it.
is this really the case? There is no way to supply them with a certreq
without the secret key material? I would find that really surprising,
and it should be better publicized if that's so.
> A BIG security hole, especially since they're (also) US based,
actually, startssl is based in israel. whether that's better or worse
than being based in the US, i leave as an exercise to the reader.
--dkg (who is based in the US)
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
