3 ms·

Can you expound on your last point?

• deleted 12y ago
  [deleted]
• girvo 12y ago
  If you assume the rest of his comment is true (I'm no crypto expert but it seems intuitive enough for me, and he is a crypto expert!), having something like a session cookie (which can be attacker controlled) encrypted with GPG (which means it's now "online", without manual intervention) has now increased the attack surface considerably; it gives up the neat offline part of GPG and makes it easier to attack. That's how I understood it anyway!
  • tptacek 12y ago
    Yep.