Re: mutt/gpg social attack
On Mon, Aug 23, 2004 at 09:46:02AM +0200, Thomas Glanzmann
<sithglan@xxxxxxxxxxxxxxxxxxxx> wrote:
http://www.securityfocus.com/bid/10929
Hmm, an interesting thought is here:
http://marc.theaimsgroup.com/?l=mutt-dev&m=100402857100619&w=2
Quote (from Mike Schiraldi <raldi@xxxxxxxxxxxxxxxxxxx>):
Ultimately, i think the best solution is to add a command like the
following to define whom you expect to sign their messages:
signers-include bob@xxxxxxxxx
signers-include .*@verisign.com
signers-exclude ralph@xxxxxxxxxxxx
And then if mutt sees a message that should be signed but isn't, it can set
off warnings, possibly even prompting the user before displaying the
message.
--
Bob Bell <bbell@xxxxxxxxxxxxxxxxxxxxx>