On Sat, Mar 16, 2002 at 07:20:34PM -0500, Dave Baker wrote: > On Sun, Mar 17, 2002 at 12:51:50AM +0100, Jeroen Dekkers wrote: > > On Sat, Mar 16, 2002 at 05:45:23PM -0500, Dave Baker wrote: > > > So, what with this happening to two (three?) developers in pretty quick > > > succession, I think we should add something to the NM process to ensure > > > that all future developers *HAVE A REVOCATION KEY AVAILABLE*? It wouldn't > > > be such a bad idea for everyone who's read this far to take the five > > > minutes it requires to double-check that they have one themselves... > > > > What about making a backup of your secret key in a safe place? Where > > safe means as safe of safer then your secret key on your > > computer. > > > > If you should forget your passphrase, a backup copy of the secret key > doesn't help since you can't revoke it. You should have both. And you should not forget your passphrase, of course. It happened once to me but I remembered it a few days later. > If someone gains access to the > copy of the secret key they can attempt to attack the passphrase and thus > impersonate you. If someone gains access to your revocation key they can > cause severe annoyance (by using it) but can't do much else with it. True, but somebody who can get your harddisk can get it also. That means you can store in a place which is as safe as your hard disk. Jeroen Dekkers -- Jabber supporter - http://www.jabber.org Jabber ID: jdekkers@jabber.org Debian GNU supporter - http://www.debian.org http://www.gnu.org IRC: jeroen@openprojects
Attachment:
pgp9IT_vCAeP2.pgp
Description: PGP signature