[45914] in Cypherpunks
Re: Only accepting e-mail from known parties
daemon@ATHENA.MIT.EDU (Adam Shostack)
Mon Dec 25 12:57:16 1995
From: Adam Shostack <adam@homeport.org>
To: dlv@bwalk.dm.com (Dr. Dimitri Vulis)
Date: Mon, 25 Dec 1995 12:54:30 -0500 (EST)
Cc: cypherpunks@toad.com (Cypherpunks Mailing List)
In-Reply-To: <X8BogD7w165w@bwalk.dm.com> from "Dr. Dimitri Vulis" at Dec 25, 95 11:41:32 am
Dr. Dimitri Vulis wrote:
| I said, Carol can *forge* the RFC 822 header, so her e-mails look like they
| came from Bob, and use the body from Bob's authentic PGP-signed message.
Yes, this is possible. No, I'm not going to take the time to
write a fix now, but, we both know its not tough to prevent.
Take the hash of the pgp signed message, use it to filter on.
I'll occaisonally add text outside a signature (literally, a
postscript), so filtering out everything outside the signed text is a
bad idea. You might get a few spams, but not hundreds. Its tough to
ensure that mail always has an envelope that matches the key. I still
use a key that say adam@bwh.harvard.edu, but most of my mail is signed
with an adam@homeport.org key.
Cryptography can't solve social problems. It can, however,
transform them into tougher problems for the anti-social.
Adam
--
"It is seldom that liberty of any kind is lost all at once."
-Hume
