gnupg encrypted mail and malware/spam

[darren chamberlain]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

* Thomas Scheffczyk <thomas.scheffczyk at verwaltung.uni-mainz.de> [2003-05-12 08:55]:
> I do not fear 'ordinary' viruses or other malware. What i really fear
> is a sophisticated attacker that send on a very slow rate backdoors to
> single users in my network. I can not guarantee the really no user will
> start the program. If it is started, it's easy to create a backchannel
> over allowed traffic like http.

The third sentence ("I can not guarantee the really no user will start
the program") makes me think this might be a problem solved by a policy,
or by social means, not technology, or at least not only technology.
For example, several years ago, I worked in a place where email clients
capable of executing code were *explicitly forbidden*, in order to
prevent this from happening.

(darren)

- -- 
Do what thou wilt shall be the whole of the Law.  Love is the law,
love under will.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE+v64XzsinjrVhZaoRAt4MAJ9ctz1zZPuSSJc0UHqAGhQ8CH9EmACeLqZ4
ozwPXPPZh1hidSYOE5NPlOc=
=SV77
-----END PGP SIGNATURE-----