Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Jan 8, 2015, at 3:37 PM, John Levine jo...@iecc.com wrote: Do the fake certs validate in web browsers? No, they do not validate. If you go (went) to a Youtube, Vimeo, etc. site, URL, embedded whatever, you'd get the expected browser

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Patrick Mylund Nielsen
On Thu, Jan 8, 2015 at 6:35 PM, Jon Callas j...@callas.org wrote: Well, I'll be. I am on a Gogo-enabled flight even as we squeak, and I just turned my VPN off to go get you one of their certs. They're letting me get to YouTube and Vimeo just fine now. I guess someone got some sense. It was

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Jan 6, 2015, at 8:34 AM, shawn wilson ag4ve...@gmail.com wrote: You can smartly limit resolution in squid - I don't trust this is what they were doing, but you could provide a better experience like this. It is what they are doing. I am an

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread John Levine
It is what they are doing. I am an unhappy (for many reasons) regular (for many other reasons) Gogo customer, and noticed pretty quickly when they started doing it. I looked at their certs and it's an awful-user-experience way of blocking videos, and I strongly suspect that the rotten user

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread realcr
You still don't get any meaningful security if old band members are assumed to be untrusted and you don't use a public checkpointing mechanism. Transfer of the title of being the real group must be a one-time only thing for each version of the group, and must be impossible to backtrack from.

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread Michael Rogers
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/01/15 07:03, realcr wrote: I think the naive solution I proposed in my first message is more efficient than using Bitcoin, because it does not involve proof of work or flooding stuff. Shortly: Whenever a person is added to the band, all

Re: [cryptography] QODE

2015-01-08 Thread Michael Kjörling
On 7 Jan 2015 16:57 -1000, from yoz...@gmail.com (Open eSignForms): But if you are not a high value target, your crypto may provide adequate security as there's unlikely a cabal who will invest the resources to attempt to crack it. Life is short and freedom to explore is your right! You mean

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread realcr
Hey, thanks again for the reply. The only notable difference is that in my version you are checkpointing the change in th blockchain. You still have the very same form of signing, but you sign a slightly different message (transfer of a colored coin, one Satoshi worth of Bitcoin, to a new

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread Natanael
Den 8 jan 2015 08:03 skrev realcr rea...@gmail.com: Hey Natanael, Thanks for your response. It's the chain of signatures always published in an accessible way so that the original members can't doublespend and claim to be the task group? Otherwise the blockchain approach is useful for you.

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread Natanael
Den 8 jan 2015 11:54 skrev realcr rea...@gmail.com: Hey, thanks again for the reply. The only notable difference is that in my version you are checkpointing the change in th blockchain. You still have the very same form of signing, but you sign a slightly different message (transfer of a

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread realcr
Now the original members b,c,d create an alternative history: I assume that the original band has a majority of correct members. Therefore at least two out of {b,c,d} are correct, and they will not create alternate history. The original formulation is included: Assume that the world contains

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread realcr
Sorry, I should've read your formulation more carefully. Don't worry about it :) We wrote lots of stuff since the first message, it's hard to trace it back to the original message. @Natanael: I think I understand now that our different opinions are due to different concepts of adversarial

Re: [cryptography] The Wandering Music Band

2015-01-08 Thread Michael Rogers
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/01/15 13:21, realcr wrote: Now the original members b,c,d create an alternative history: I assume that the original band has a majority of correct members. Therefore at least two out of {b,c,d} are correct, and they will not create