Re: [cryptography] This is bad. THis is really bad. (Isn't it?)

2015-11-25 Thread Dave Howe
On 23/11/2015 22:33, rv...@insightbb.com wrote: > UPDATE: I've been reading that a lot of people are skeptical in the > sense that this CA can't actually do anything because the CA has no > capabilities. I did some more research and found out that this CA can > indeed sign server certificates.

Re: [cryptography] This is bad. THis is really bad. (Isn't it?)

2015-11-25 Thread Dave Howe
On 25/11/2015 12:59, Florian Schütz wrote: > This is true for Chrome and, I think, for Firefox as well. Some > enterprises insist on MITMing TLS connections at a proxy, and at least > Chrome will not break this. They argue if they were to strictly > enforce Pins, people would just switch to a more

Re: [cryptography] Caspar Bowden has died

2015-07-09 Thread Dave Howe
On 09/07/2015 15:25, Jeffrey Walton wrote: We had dinner in Washington, DC last year. He was not old by any measures, and he surely did not appear unhealthy. http://www.theregister.co.uk/2015/07/09/caspar_bowden_dies_cancer_battle/ El Reg coverage says cancer. Will be sorely missed :(

Re: [cryptography] Unbreakable crypto?

2015-03-20 Thread Dave Howe
On 20/03/2015 17:01, Kevin wrote: I am trying to contact the company and it is not easy. They don't want people looking into them or the product they offer. I guess it's fraud; I am disillusioned. If you hold real still and listen, you can here the sound of my bubble bursting. Or a

Re: [cryptography] TrueCrypt

2014-05-29 Thread Dave Howe
On 29/05/2014 09:20, Lukasz Biegaj wrote: On 29.05.2014 09:34, David Johnston wrote: Someone needs to fork the code (the version prior to the most recent change), address the issues raised in the recent audit and host it outside the jurisdiction of the US government, using fresh signing keys.

Re: [cryptography] Request - PKI/CA History Lesson

2014-04-29 Thread Dave Howe
On 28/04/2014 23:00, James A. Donald wrote: Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, they are certifying they sold a certificate to someone

Re: [cryptography] coderman's keys

2013-11-01 Thread Dave Howe
On 01/11/2013 12:04, Natanael wrote: No hints at what kind of client it takes? Custom config or recompile? From the url in the key, I am assuming it is a tor hidden service, hence you would need a local MTA able to route over TOR. tempted to have a go myself this weekend, given I haven't seen a