divulge any part of the passphrase to anyone. A secret is no longer a secret once you tell one other person. All that said, if Leigh's computer had a key logger installed... game over. Still, a great article that I enjoyed reading. I do agree with your opinion that fault lies with Leigh, and the passphrase (with the salt!!!!) being published in a book. The transfer of data could have been carried out differently and possibly avoided what happened. &gt; 6. You are probably aware that David Leigh and the Guardian's &gt; James Ball claim the file the Guardian accessed was not the same &gt; as the one now generally available, the z,pgp file, and that the two &gt; differ in file size, filename and SHA1 hash.. I have tweeted Leigh &gt; and Ball asking for the file size, filename and SH1 hash for the &gt; Guardian file. No answer from either. Megabytes, kilobytes, gigabytes, file size ... it all gets very confusing if you can't figure out what a 7zip file is. Also, Leigh may have been given a separate password for WL server access to download the encrypted zip file. @axenicely: Using public/private (asymmetric) encryption and why JA didn't use this and the answer is that it is beyond the ken of the average person to set up, which means that it was well beyond Leigh's technical capabilities ... Quick note: asymmetric cryptography with a PGP private key would only have been secure (without hindsight) if a passphrase