Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Krassimir Tzvetanov
While I'm not a lawyer and my opinion is in noway authoritive I do not believe there is any violation. They ay be an accessory to a potential crime but they themselves did not do the tapping. Now on the other hand those companies that did the tapping should be OK for as long as they are clear

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Jeffrey Walton
On Sun, Feb 12, 2012 at 5:43 AM, Krassimir Tzvetanov mailli...@krassi.biz wrote: While I'm not a lawyer and my opinion is in noway authoritive I do not believe there is any violation. They ay be an accessory to a potential crime but they themselves did not do the tapping. Now on the other

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Jeffrey Walton
On Sun, Feb 12, 2012 at 5:43 AM, Krassimir Tzvetanov mailli...@krassi.biz wrote: While I'm not a lawyer and my opinion is in noway authoritive I do not believe there is any violation. They ay be an accessory to a potential crime but they themselves did not do the tapping. I think its a bit

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Krassimir Tzvetanov
Again, I'm not a lawyer but if somebody legally purchases a gun from you for a legitimate purpose and then abuse it your are not liable (US context here). The same way if somebody purchases this cert to monitor their employees for data exfiltration (perfectly good reason, if specified in the

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Benjamin Kreuter
On Sun, 12 Feb 2012 05:57:02 -0500 Jeffrey Walton noloa...@gmail.com wrote: On Sun, Feb 12, 2012 at 5:43 AM, Krassimir Tzvetanov mailli...@krassi.biz wrote: While I'm not a lawyer and my opinion is in noway authoritive I do not believe there is any violation. They ay be an accessory to a

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread John Levine
They also claim in their defense that other CAs are doing this. Evading computer security systems and tampering with communications is a violation of federal law in the US. As the article made quite clear, this particular cert was used to monitor traffic on the customer's own network, which is

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Marsh Ray
On 02/12/2012 10:24 AM, John Levine wrote: They also claim in their defense that other CAs are doing this. Evading computer security systems and tampering with communications is a violation of federal law in the US. As the article made quite clear, this particular cert was used to monitor

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread ianG
On 13/02/12 10:53 AM, Marsh Ray wrote: On 02/12/2012 10:24 AM, John Levine wrote: They also claim in their defense that other CAs are doing this. Evading computer security systems and tampering with communications is a violation of federal law in the US. As the article made quite clear, this

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Nico Williams
On Sun, Feb 12, 2012 at 9:13 PM, Krassimir Tzvetanov mailli...@krassi.biz wrote: I agree, I'm just reflecting on the reality... :( Reality is actually as I described, at least for some shops that I'm familiar with. ___ cryptography mailing list

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Steven Bellovin
On Feb 12, 2012, at 10:26 46PM, Nico Williams wrote: On Sun, Feb 12, 2012 at 9:13 PM, Krassimir Tzvetanov mailli...@krassi.biz wrote: I agree, I'm just reflecting on the reality... :( Reality is actually as I described, at least for some shops that I'm familiar with. The trend is the

Re: [cryptography] trustwave admits issuing corporate mitm certs

2012-02-12 Thread Nico Williams
I'm sure the trend is currently the other way, yes, but with low-cost high-bandwidth wireless becoming more common it doesn't really matter, does it? And it all depends on the organization and it's risk taking profile. But to bring this back on topic: I'd rather see draconian corporate network