Contrary to popular belief, stealing someone's digital identity is a snap. It almost seems as though the more we use digital identities, the easier they are to swipe. The reason can be attributed to general carelessness or perhaps outright ignorance, but whatever the case, letting your digital identity fall into the wrong hands can expose you and your organization to a world of headaches. Case in point: I routinely use Pretty Good Privacy (PGP) and SMIME to secure e-mails and file transfers. Yet frequently, even somewhat knowledgeable IT security people get confused about which keys to use when. In order to for someone to send me encrypted content, I need to send that person my public key. Similarly, I need the recipient's public key so that I can send him or her encrypted content. We should never share private keys. That's why they are called private. Pretty simple -- or so you would think. More often than not, if the person isn't overly familiar with PGP/SMIME, even if they've been using it, they send me their private key.
