Problems in Private-Key Management


People store private keys poorly!

Example: SSH, PGP private keys in NFS home directories

Using filesnarf (from the dsniff suite) to sniff NFS traffic, I have successfully grabbed users' ~/.pgp/secring.pgp and ~/.ssh/identity private key files