From: "Antti Kurenniemi" 

If you have a few moments, can you explain to me how does the signing
actually work? Because I just don't get this, it seems to me to be just one
extra step sideways but nothing more - just one more thing to take control
of (hack), and hey presto now you can mess around with the signatures, and
the recipients will happily launch every bomb because "hey, it's
signed so it must be safe".

Is there a proper explanation somewhere that I could read? I did a bit of
googling, but all I could find was some vague stuff like this:
http://www.winnetmag.com/Article/ArticleID/15315/15315.html - but that
would mean that if someone broke to my system via some other security hole,
they could send signed mail as me, right?


Antti Kurenniemi


"Rich"  wrote in message news:406d08ac$1{at}w3.nls.net...
Self-signed would get you nowhere.  It is not sufficient for a message to
be signed.  The certificate has to chain to a trusted root plus other
requirements like not being revoked.  No self-signed cert would be trusted
by the recipient.

Rich

--- BBBS/NT v4.01 Flag-5