Re: Mail-Followup-To (was Re: IDEA License)

2013-03-29 Thread Julian H. Stacey
Peter Lebbing wrote: > On 27/03/13 14:40, Julian H. Stacey wrote: > > I created it, as far as I recall, from my copy direct from Ulrich, > > which had no Mail-Followup-To > > Correct, the problem originated when you replied[1] to Werner's mail[2]. > Werner's mail had the following header: > > Ma

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread Forlasanto
On 3/29/2013 3:21 PM, Paul R. Ramer wrote: > A scandal is unlikely unless the people have wildly unrealistic > expectations in the performance of the victim. The only way I could > see you having a scandal on your hands if your identity was revealed > would be if you made claims that it couldn't be

Re: GnuPG Crashing on Windows 8

2013-03-29 Thread Johan Wevers
On 28-03-2013 12:13, Kristine Concha wrote: > Dear Support, This mailinglist is not an official supportline. > GnuPG is crashing on my Windows 8 machine: I recommend upgrade to windows 7 or XP. You are getting an error in some GUI components, not in GnuPG itself. You can't expect all GUI develo

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread Paul R. Ramer
On 03/29/2013 11:17 AM, adrelanos wrote: >> Using your real identity would be the alternative. The trade-off is >> easier key signatures vs. identity obscurity. > >> It would only be safer in >> the sense that there won't be a scandal when/if your identity is >> uncovered. > > Why would that be a

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread adrelanos
Peter Lebbing: > On 27/03/13 22:15, Leo Gaspard wrote: >> until a lot of people verify and sign your public key. > > People might be more inclined to sign the key when it says something like > > adrelanos (Whonix signing key) Yes, that a good suggestion worth to try and simple to do for my next

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread adrelanos
Markus Reichelt: > * adrelanos wrote: > >> How can I establish a pseudonym that no one can easily fake while >> remaining anonymous? > > a) you can't > define 'easily' - these days nobody reads/checks anything anymore > (there's some XKCD about this issue) Well, I recognize that ratio of image

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread adrelanos
Johnicholas Hines: > The question is how to distinguish yourself from a nation-state's covert > agency purporting to be an individual interested in anonymity; you need to > do something that the agency would find difficult to do. I don't think that's possible at all. > Getting your name and key i

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread adrelanos
Forlasanto: > On 3/29/2013 9:38 AM, adrelanos wrote: >>> Forgive me for saying so, but for something as high-profile as a linux >>> distro, using a pseudonym for signing the distro for the sake of >>> anonymity doesn't sound like a great plan. >> What's the alternative? Using my real identity? Does

gpg for pseudonymous users [was: Re: gpg for anonymous users - Alternative to the web of trust?]

2013-03-29 Thread Daniel Kahn Gillmor
I've changed the subject line to indicate that this thread is about establishing a pseudonym, *not* about anonymous users. This is a subtle but important difference. On 03/29/2013 12:41 PM, Forlasanto wrote: > The web of trust is simply a conventional way for people to judge how > trustworthy yo

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread Forlasanto
On 3/29/2013 9:38 AM, adrelanos wrote: >> Forgive me for saying so, but for something as high-profile as a linux >> distro, using a pseudonym for signing the distro for the sake of >> anonymity doesn't sound like a great plan. > What's the alternative? Using my real identity? Does it make it any sa

Re: gpg for anonymous users - Alternative to the web of trust?

2013-03-29 Thread adrelanos
Forlasanto: > Pseudonyms are fine by me. I don't have a problem signing a pseudonym > key. The pseudonym just has to have context that I can verify. For > instance, if the claim is "Whonix signing key," then that tells me the > way to verify the key is by checking the signature of various releases