And amazingly, we've had ways of preventing this forgery for decades. PGP has had ways of distributing and validating public keys and signing documents since the first time I saw it, and with MIME we have standard ways of packaging signatures up along with arbitrary binary documents. When both creator/sender and recipient sign the document it can become unforgeable even by the signing parties. If the whole process isn't sexy and integrated enough for the suits, that's a much simpler problem to solve I'm sure.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11228/32043#32043