from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 149BE4417B
	for <jm@localhost>; Mon, 12 Aug 2002 05:57:17 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Mon, 12 Aug 2002 10:57:17 +0100 (IST)
from xent.com ([64.161.22.236]) by dogma.slashnull.org
    (8.11.6/8.11.6) with ESMTP id g7BLDpb14306 for <jm@jmason.org>;
    Sun, 11 Aug 2002 22:13:52 +0100
from lair.xent.com (localhost [127.0.0.1]) by xent.com (Postfix)
    with ESMTP id 3BADE294190; Sun, 11 Aug 2002 14:10:07 -0700 (PDT)
from venus.phpwebhosting.com (venus.phpwebhosting.com
    [64.29.16.27]) by xent.com (Postfix) with SMTP id 6510B29418F for
    <fork@xent.com>; Sun, 11 Aug 2002 14:09:32 -0700 (PDT)
from unknown (HELO hydrogen.leitl.org) (217.80.40.11) by
    venus.phpwebhosting.com with SMTP; 11 Aug 2002 21:10:34 -0000
from localhost (eugen@localhost) by hydrogen.leitl.org
    (8.11.6/8.11.6) with ESMTP id g7BLAUZ05996; Sun, 11 Aug 2002 23:10:30
    +0200

> > Users don't like entering passphrases when sending email. USB fobs, smart
> > cards or other removable hardware are not yet widespread.
Not really. If code can sign stuff without me being aware of it that
pretty much invalidates the (already tenuous, since it assumes me trusting
the contents of the frame buffer) concept of a digital signature.
A secure piece of hardware puts the keyring outside of any code's reach.
The key never leaves the hardware compartment. I have to mechanically
acknowledge a signing process. The cryto fob then falls back to the
I'm pretty comfortable with entering my passphrase every time. This is not
production key, as I usually access my home box via a SSH session, and SSH
sessions are easily attackable with a model of your typing pattern. So
don't expect me to announce my plutonium shipments via this medium.
> For some of myy workstations, I'd even be happy with the necessary
> signing key being cached on disk, so signing is automatic when I
> If spammer code can read my local hard disk, I have bigger problems
I agree. Nevertheless, a number of people who use cryptography have their
- -- Eugen* Leitl <a href="http://leitl.org">leitl</a>