Radical Paranoia?

[Paul Goggin]

>Lets say someone emails me a key and the return address matches that of
>the address in the key.  Do I assume no one is spoofing me?  You have to
>admit that this is possible albeit unlikely.  What good is key certification
>if it only "probably valid?"  I've noticed that many of the keys on the
>server are signed with the same person's key.  I doubt that these people
>have had physical contact with each of the people who's key that they've
>signed.  Am I just being paranoid, or is there a valid issue here?  I
>welcome any of your comments.

I understand your precaution and problem very well. I have had similar fears.
Recently, I was in similar situation recently. I wanted to exchange keys
with someone I have met only once. The situation as it arose actually ended
up working okay. We exchanged keys after encrypting them with the normal
encryption option, with a password being someone at the place we meet.
Knowledge common to only a few select people. Then we started a talk session
at a prescribed time at the relevant addresses and tried to rely on information
specific dialogue to verify one's person as the one in question. Without
physically being there this seems like at least a little extra security.
As to the broader question you are really asking on verification I am unsure
on how it can be solved. Obviously my situation was unique that we had met
and could decide on an information basis, that would seemingly be hard to
duplicate, but this is not always available.

Paul
--
R  O    All Comments Copyright by  | Technofetisht
 A  N     Paul S. Goggin (1993)    | Cypher, Cyber, Chaos              
  V        Information Broker      | Ergoflux, Interzone
   E      chaos at aql.gatech.edu     | Carpe Diem: Stop the Clipper wiretap chip 
Finger account for latest _Phrack_ | Public Key: PGP and RIPEM available
      For anonymous communication:---> anonymus+4744 at charcoal.com
------------------------------------------------------------------------------
Title 18 USC 2511 and 18 USC 2703 Protected -- Monitoring Absolutely Forbidden