Re: why pgp sucks

>"Perry E. Metzger" <perry@imsi.com> writes:
>>I'll also note, yet again, that unless PGP quits this bad practice of
>>identifying counterparties only by a number, it is NOT going to be
>>universally deployed. Counterparties need to be identified by a name
>>that can be looked up in the DNS -- meaning "joe@foo.com" rather than
>>some key ident number.
>
>PGP of course looks up keys by strings in addition to numbers.  A widely
>accepted practice is to use <joe@foo.com> in the user ID which allows the
>lookups to be by internet address.  PGP was intended for use beyond the
>internet, such as in bbs's, fidonet, corporate networks, etc., where DNS
>style addresses may not be useful.
 
I would prefer that PGP would not give out ANY info about addressees.  It 
would seem to me that it is quite a security breach to have PGP dutifully 
tell you to whom it is addressed.  
 
************************************************************
*           Just your basic signature block                *
*                                                          *
*  Al Thompson                                             *
*  Fidonet 1:231/110                                       *
*  alt@iquest.net                                          *
************************************************************

alt@iquest.net (Al Thompson) writes:
>I would prefer that PGP would not give out ANY info about addressees.  It 
>would seem to me that it is quite a security breach to have PGP dutifully 
>tell you to whom it is addressed.  

PGP could be hacked fairly easily to do this (in fact there is a
program around called stealth that does this to some extent), however
in the context of this discussion we were discussing more the issue of
checking the signature on a file.  For that we do need a hint about
whose signature purports to be there.  PGP presently provides this in
the form of the low-order 64 bits of the key modulus, and this provides
problems in implementing the key database in distributed form.

Hal