<<< Date Index >>>     <<< Thread Index >>>

Re: mutt/gpg social attack



On Monday, 23.08.2004 at 09:20 -0400, Bob Bell wrote:

> On Mon, Aug 23, 2004 at 09:46:02AM +0200, Thomas Glanzmann 
> <sithglan@xxxxxxxxxxxxxxxxxxxx> wrote:
> >http://www.securityfocus.com/bid/10929
> 
> Hmm, an interesting thought is here:
> http://marc.theaimsgroup.com/?l=mutt-dev&m=100402857100619&w=2
> 
> Quote (from Mike Schiraldi <raldi@xxxxxxxxxxxxxxxxxxx>):
> Ultimately, i think the best solution is to add a command like the
> following to define whom you expect to sign their messages:
> 
> signers-include bob@xxxxxxxxx
> signers-include .*@verisign.com
> signers-exclude ralph@xxxxxxxxxxxx
> 
> And then if mutt sees a message that should be signed but isn't, it can set
> off warnings, possibly even prompting the user before displaying the
> message.

I do the above like this:

color index brightmagenta default   "~f usual-signer@xxxxxxxx"
color index brightmagenta default   "~f other-signer@xxxxxxxxxxxxx"
etc.

This makes messages from known signers appear pink.  Then, later, I
have:

color index brightgreen default "~g" # signed messages
color index brightgreen default "~G" # encrypted messages

which makes signed messages green.

This means that unsigned messages from people who normally send me
signed stuff appear in pink in the index, drawing my attention to it.

I like the signers-include idea above, though.

Dave.
-- 
Dave Ewart
Dave.Ewart@xxxxxxxxxxxxx
Computing Manager, Epidemiology Unit, Oxford
Cancer Research UK
PGP: CC70 1883 BD92 E665 B840 118B 6E94 2CFD 694D E370

Attachment: signature.asc
Description: Digital signature