On Fri, 10 Jan 2020, John Sechrest wrote:
Since the keys are a security issue on several fronts, it would be wise to keep it as a separate service that you can maintain with somewhat high security monitoring.
And here's the rub. Identity assurance is a hard problem to solve.That's one of the things about just-like-SSH model that I like. It's good enough for most communication. You accept the initial conversation as legitimate (and it will be in 99%+ of the cases) and only worry when things change unexpectedly.
That might not pass muster for communications with strict legal requirements (HIPAA, FERPA, DoD), but it'd be fine for ordinary interactions I'd want to keep secret: discussing financial issues with an advisor, helping a friend with a marriage issue, getting Rich S's procmail recipes in order (ha!), etc.
-- Paul Heinlein heinl...@madboa.com 45°38' N, 122°6' W
_______________________________________________ PLUG mailing list PLUG@pdxlinux.org http://lists.pdxlinux.org/mailman/listinfo/plug
