3 ms·
Also, if somebody manages to get access to your email client, they can't just issue email based password resets to get access to all of your other accounts, bec
by mike-cardwell 12y ago
Also, if somebody manages to get access to your email client, they can't just issue email based password resets to get access to all of your other accounts, because they wont be able to read the confirmation emails without your PGP key.
- x1798DE 12y agoI'm not really sure what attack you are envisioning here. If they have access to your e-mail client, they should be able to just lift your account credentials, allowing them to add a new PGP key to the key ring, then issue all the password resets and, if you want, change the PGP key back.
- mike-cardwell 12y agoNot sure why you think "knows username and password to access email" has to mean "has permission to change the PGP key assigned to the account"