I want to remind folks of another _practical_ security weakness in using PGP or any other crypto program: keystroke capture utilities. These are small utilities (inits in Mac terms, perhaps TSRs in DOS terms, and who knows what in Windoze terms) that record all keyboard input. Very useful for recovering from crashes and such. These started in the Unix community, where I've forgotten the name ("history"?). In the Mac community, "Last Resort" has been doing this for a couple of years, and now several other packages offer similar capabilities (QuicKeys has "GhostWriter," or somesuch). Many's the time I've forgotten I had thse things enabled, only to find in my System Folder a folder marked "Saved Work" or the like, containing files of all the histories from each rebooting. The security risks are obvious: * passphrases (and perhaps even the original key generation process, in toto) are captured over and over again. * the stored history files may be tucked away in odd places on one's disk, on various backup tapes made, and so on. (Easily recoverable with search warrants.) * anyone with access to one's machine (a snoopy coworker, an employer, a spouse, even an NSA black bag job) can insert this harmless-looking utility and then pick up the results later. There are commands to bypass such keystroke capture--specifically intended to head off these breaches--but most people will forget sometimes, and may not even know the program is installed. (And there are at least 3 of these for the Mac, so confusion is increased.) This is a well-known security concern, but I thought it important to mention. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."