Re: Another entry in the internet security hall of shame....

2005-08-27 Thread Aaron Whitehouse
Ian G wrote: > Using SSL is the wrong tool > for the job. It's a chat message - it should be > encrypted end to end, using either OpenPGP or > something like OTR. And even then, you've only > covered about 10% of the threat model - the > server. > > But, if people do use the wrong tool for the

Re: Financial identity is *dangerous*? (was re: Fake companies, real money)

2004-10-23 Thread Aaron Whitehouse
Ian Grigg wrote: James A. Donald wrote: we already have the answer, and have had it for a decade: store it on a trusted machine. Just say no to Windows XP. It's easy, especially when he's storing a bearer bond worth a car. What machine, attached to a network, using a web browser, and sending a