paperkey // ? feature request

[David Shaw]

On Feb 10, 2009, at 7:25 PM, Robert J. Hansen wrote:

> Faramir wrote:
>>  IMHO, the difference is the recipients can send it's public to me by
>> some way, and check the fingerprint by telephone...
>
> It's not a disposable session key if the recipients need to contact  
> the
> sender afterwards.  If you're assuming a high threat environment, you
> kind of need to assume the sender got flipped right after sending the
> message.
>
>> But how? There is still the chance to buy things with effective, not
>> with credit or debit cards, and USB Flash Drives are cheap enough and
>> easy to find at stores to make it very hard to trace...
>
> Timothy McVeigh was tracked through his use of a prepaid calling  
> card...
> which he paid for with cash.

Not exactly: http://www.wpi.edu/News/Journal/Summer98/secured_opus.html

But still, I can imagine several ways USB drive can be traced - even  
if it has a non-unique serial number and paid for with cash.  Most of  
them sound somewhat silly outside of a movie (which doesn't make them  
impossible - just amusing).

David