Find your dream

2003-06-05 Thread Sandra Long
Hello, Why waste money on a date? Get the Escort Girl of your dream! 1000's of REAL WOMEN to chose from. Browse through the photos and profiles of the lady you want, meet her online, meet her at home... You say, she does Example: Name: Meghan S.Age: 22Height: 5.6"Dimensions: 35 D 25 36 "I

Why is there a solution, Declan?

2003-06-05 Thread Adam Shostack
Declan interviews Bruce Sterling, on news.com.com.com: http://news.com.com/2008-1082_3-1010864.html?tag=fd_nc_1 -- It is seldom that liberty of any kind is lost all at once. -Hume

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Rich Salz
In attempting to solve the hard problem, it fails to make provision for solving the easy problem. That's a deployment issue, not a technical issue. D-H key exchange, for example, would be just fine. It just so happens that the SSL creators had a particular business goal in mind: e-commerce,

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Anne Lynn Wheeler
At 12:02 PM 6/4/2003 +0100, Dave Howe wrote: For that matter, our system here discards the CC after use (the pre-auth step with the merchant bank agent gives us back a fulfillment handle that can only be used to fulfill or cancel that individual transaction - but of course Amazon *want* to keep

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Peter Gutmann
Eric Murray [EMAIL PROTECTED] writes: Too often people see something like Peter's statement above and say oh, it's that nasty ASN.1 in X.509 that is the problem, so we'll just do it in XML instead and then it'll work fine which is simply not true. The formatting of the certificates is such a

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Eric Rescorla
James A. Donald [EMAIL PROTECTED] writes: -- James A. Donald Or to say the same thing in different words -- why can't HTTPS be more like SSH?Why are we seeing a snow storm of scam mails trying to get us to login to e-g0ld.com? Eric Rescorla Because HTTPS is designed to let

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread James A. Donald
-- Everyone in America has several shared secrets identifying them -- the number of the beast to identify them to the state, and their credit card numbers identifying them to various financial institutions, plus a hundred passwords to login to their email, their bank, their network

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Rich Salz
The problems that this creates are demonstrated by what happens when technically skilled users are required to work with certificates. If you haven't already seen it, I highly recommend Don Davis's compliance defects paper (and slides!) available at http://world.std.com/~dtd. Abstract

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Bodo Moeller
On Thu, Jun 05, 2003 at 10:11:45PM +1200, Peter Gutmann wrote: Bodo Moeller [EMAIL PROTECTED] writes: Using an explicit state machine helps to get code suitable for multiplexing within a single thread various connections using non-blocking I/O. Is there some specific advantage here, or is it

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Bodo Moeller
[EMAIL PROTECTED] (Peter Gutmann): [0] Note that my SSL implementation follows the standard SSL ladder diagram rather than the state-machine that SSL implementations are usually described as, which made it trivial to switch over for SSHv2 use. I've never understood why every

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Eric Murray
On Wed, Jun 04, 2003 at 04:32:23PM +1200, Peter Gutmann wrote: James A. Donald [EMAIL PROTECTED] writes: I never figured out how to use a certificate to authenticate a client to a web server, how to make a web form available to one client and not another. Where do I start? There's a

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Peter Gutmann
Bodo Moeller [EMAIL PROTECTED] writes: Using an explicit state machine helps to get code suitable for multiplexing within a single thread various connections using non-blocking I/O. Is there some specific advantage here, or is it an academic exercise? Some quirk of supporting certain types of

RE: SIGINT planes vs. radioisotope mapping

2003-06-05 Thread Trei, Peter
Major Variola (ret)[SMTP:[EMAIL PROTECTED] At 05:28 PM 6/3/03 -0700, Tim May wrote: Possibly for construction of baseline maps of existing radioisotopes in university labs, hospitals, and private facilities. Then deviations from baseline maps could be identified and inspected in more

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread James A. Donald
-- James A. Donald Or to say the same thing in different words -- why can't HTTPS be more like SSH?Why are we seeing a snow storm of scam mails trying to get us to login to e-g0ld.com? Eric Rescorla Because HTTPS is designed to let you talk to people you've never talked before,

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Eric Rescorla
James A. Donald [EMAIL PROTECTED] writes: -- On 3 Jun 2003 at 15:04, James A. Donald wrote: I never figured out how to use a certificate to authenticate a client to a web server, how to make a web form available to one client and not another. Where do I start? What I and

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Sunder
Depends on how it gets passed from the web servers to that computer. If it's encrypted with a public key on the web server that only the database has the private half, you're safe from someone sniffing that proprietary one-way interface. However, if somone's already broken into the web server,

Re: Maybe It's Snake Oil All the Way Down

2003-06-05 Thread Eric Rescorla
James A. Donald [EMAIL PROTECTED] writes: Eric Rescorla Nonsense. One can simply cache the certificate, exactly as one does with SSH. In fact, Mozilla at least does exactly this if you tell it to. The reason that this is uncommon is because the environments where HTTPS is used are