Re: [cryptography] Improving the state of end-to-end crypto
On 28 April 2014 00:45, Arshad Noor arshad.n...@strongauth.com wrote: On 04/27/2014 10:33 AM, Ben Laurie wrote: http://www.links.org/files/SimplySecure.pdf Ben, As noble as the goals are of this initiative, the solution is likely to be accepted only in UK and the USA - only because it appears that the people behind this effort are from those two countries. Given Snowden's revelations, why should anyone outside these two countries trust anything crypto emanating from the US UK? If you read the documentation, we are not intending to create new crypto. If we really want to see a universal crypto-protocol that works across the internet, the team that designs it must have representation from the US/UK's allies and enemies. If there are weaknesses in the design, then everyone stands to lose (and hopefully, the protocol never sees the light of day); if it is strong enough, then everyone is protected. Since we haven't hired the team yet, this seems like a premature criticism. I believe Bruce Schneier wrote that the US has proven itself to be a poor steward of the internet; to that extent if we want (reasonably) universal trust in a new crypto-protocol, its design must have representation from anyone that has a stake in it; anything less will only end up in balkanizing the internet from a crypto perspective. You appear to be describing the IETF. Arshad Noor StrongAuth, Inc. P.S. Note that the solution to the problem cannot merely be a technical one; crypto is a political tool, and in a borderless internet, the solution to the problem must account for the politics of trust. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] [Cryptography] Improving the state of end-to-end crypto
On 28 April 2014 01:04, ianG i...@iang.org wrote: On 27/04/2014 18:33 pm, Ben Laurie wrote: We are hiring to improve the state of end-to-end crypto: http://www.links.org/files/SimplySecureProgramDirectorJobPosting.pdf http://www.links.org/files/SimplySecure.pdf To paraphrase, work with ... Advisory Board, developer communities, academics, funders, civil society, private partners, existing contacts - yours and others’ - developers, designers, academics, complimentary efforts, security experts, academics, and partners, auditors, conferences, venues,... Everyone *but the users* !! Shake it up, Ben. You can't improve the lot of the users unless you actually meet some of them. Clearly we have not explained ourselves well. Sigh. Usability is core to our proposal, and yes, we intend to involve users in determining how to do that (unconventional, I know). iang ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] [Cryptography] GCC bug 30475 (was Re: bounded pointers in C)
The criminal liability of NSA, other spies corps, orgs and comsec wizards in de facto complicit deception and exploitation of the public is a worthy topic to drag out of the hideaways. It might be demonizing of the valiant code warriors to be described as a Racketeer Influenced Criminal Organization operating under the cheerfully duplicitous Open Source. Open secrecy is the main tool of these sub rosa hoodlums, Mafioso mathematicians wiggling out of responsibility by algo shadiness and protestations of public service on behalf of working around censorship to free the slaves for better use producing cream for the privacy milkers. Top of the cream milkers adopt the aggrieved innocence when caught red-handed rustling public cattle, hello Mr. Bundy. So sue me, they laugh, knowing no jury could possibly grasp the arcane lingo the bozos use to semaphor signals about their nefaria promoted as good for the commonweal. Subsidize us, befuddled citz, kachink. A huge market ripoff, comsec, privacy and freedom of the Internet. Simple beginnings with a few crafty ne'er do well engineers, mathematicians and scientists, avoiding penal labor in labs, factories and spynests, setting up a quiet racket to control and monetize crypto, comsec and privacy while selling hacks and snitching to the fuzz downtown. Which has produced a boom in profits and reputations for the TLA- and nick-named coders, hackers, exploiters, leakers, promoters, apologists, yes, even populist heros and awards winners from Anonymous to Alexander to Snowden and this very list of who's who in wily coyotes. Code-wielding Corsicans never had it so good since the opening of the Internet frontier to unfettered gangsters claiming to be comsec enforcers for Judge Roy Bean west of Silicon Valley). Just saying howdy to my gang of cypherpunks free rangers for whom working around law-enforcement fences while informing, backdooring, and cheating on each other is top secret code of silence Omerta. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Improving the state of end-to-end crypto
On Sun, Apr 27, 2014 at 7:45 PM, Arshad Noor arshad.n...@strongauth.com wrote: On 04/27/2014 10:33 AM, Ben Laurie wrote: http://www.links.org/files/SimplySecure.pdf Ben, As noble as the goals are of this initiative, the solution is likely to be accepted only in UK and the USA - only because it appears that the people behind this effort are from those two countries. Given Snowden's revelations, why should anyone outside these two countries trust anything crypto emanating from the US UK? It's reassuring that the political, moral and ethical views of everyone in a country all line up perfectly. This allows me to immediately trust the views of everyone from *my* country, while also being wary of those from all *other* countries. Certainly makes discriminating against others much simpler... Or is that not what you are saying? If we really want to see a universal crypto-protocol that works across the internet, the team that designs it must have representation from the US/UK's allies and enemies. If there are weaknesses in the design, then everyone stands to lose (and hopefully, the protocol never sees the light of day); if it is strong enough, then everyone is protected. Yes. I believe Bruce Schneier wrote that the US has proven itself to be a poor steward of the internet; Errr, hang on, you mean Bruce Schneier, that chappie with the pony tail *from the US*? Didn't you just say that stuff from people from the US and UK cannot be trusted? Please, don't assume that just because the NSA, GCHQ, etc did crappy things that everyone in the US and UK supports this behavior. If things were as black and white as you are implying, the NSA would simply fund folk in other countries, and the result would pass the sniff test. Output should be judged based upon review of the technology, and the individuals involved, not simply by the flag on the front of the box... to that extent if we want (reasonably) universal trust in a new crypto-protocol, its design must have representation from anyone that has a stake in it; anything less will only end up in balkanizing the internet from a crypto perspective. Yes, 100% agree -- but I didn't see anything in the job posting that said US Citizens Only, please send front page of passport as proof. or similar. In fact, the job posting says: By a leader we mean our first hire and the person who will build this **global project.** (emphasis added). Yes, there is a perception problem here -- but I think that choosing a security solution based upon nationalistic lines is dangerous Arshad Noor StrongAuth, Inc. Sunnyvale, CA 94086 USA P.S. Note that the solution to the problem cannot merely be a technical one; crypto is a political tool, and in a borderless internet, the solution to the problem must account for the politics of trust. Sorry, I suspect that I may have just gotten up on a soapbox and gone on a bit of a rant -- I might be overly sensitive to this topic. I was born in South Africa and now live in the USA. For the first while, people meeting me assumed that I supported apartheid simply because of the fact that I was a white South African. The don't trust technology X because a UK / US / Hungarian touched it meme feels similar to me... Full disclosure: I happen to work for Google (but hadn't heard about this till now). Speaking as an individual (who hasn't has his morning coffee and is a little grumpier than usual today...) ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
On 28/04/2014 20:58 pm, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. cof it's them that have shown themselves totally incapable of doing anything about it. Indeed, it's them that stopped others doing anything about it. Although it should be easier establishing your own certificate authority. Oh, they fixed that too :) iang ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
trust is outsourced all the time in the non-cryptographic world unless you do not have a bank account On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
On 29/04/2014 00:12 am, Ryan Carboni wrote: trust is outsourced all the time in the non-cryptographic world trust is built up all the time, risks are taken all the time, choice is taken all the time. unless you do not have a bank account That's not outsourced, that's direct, person to bank, the person has a choice, chooses to place her trust in that bank. Also, it is limited to defined things that are required, can't be done by the person, and bolstered by real backing such as FIDC. When you suggest it's probably best we trust authorities that is CA-playbook crapola meaning you must trust the authorities that have been picked for you. The vector has been reversed, people are told what has to happen, so there is no trust. Trust derives from choice. Where is the choice? iang On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com mailto:jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. _ cryptography mailing list cryptography@randombit.net mailto:cryptography@randombit.net http://lists.randombit.net/__mailman/listinfo/cryptography http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
One can always start with the difficult first step of uninstalling certificate authorities you do not trust. On Mon, Apr 28, 2014 at 4:42 PM, ianG i...@iang.org wrote: On 29/04/2014 00:12 am, Ryan Carboni wrote: trust is outsourced all the time in the non-cryptographic world trust is built up all the time, risks are taken all the time, choice is taken all the time. unless you do not have a bank account That's not outsourced, that's direct, person to bank, the person has a choice, chooses to place her trust in that bank. Also, it is limited to defined things that are required, can't be done by the person, and bolstered by real backing such as FIDC. When you suggest it's probably best we trust authorities that is CA-playbook crapola meaning you must trust the authorities that have been picked for you. The vector has been reversed, people are told what has to happen, so there is no trust. Trust derives from choice. Where is the choice? iang On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com mailto:jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. _ cryptography mailing list cryptography@randombit.net mailto:cryptography@randombit.net http://lists.randombit.net/__mailman/listinfo/cryptography http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
On 29/04/2014 01:20 am, Ryan Carboni wrote: One can always start with the difficult first step of uninstalling certificate authorities you do not trust. Yup. And if you don't like your country, you can hand in your passport on the way out. Marketing lies aside, it is clear that the ordinary user has no choice. iang On Mon, Apr 28, 2014 at 4:42 PM, ianG i...@iang.org mailto:i...@iang.org wrote: On 29/04/2014 00:12 am, Ryan Carboni wrote: trust is outsourced all the time in the non-cryptographic world trust is built up all the time, risks are taken all the time, choice is taken all the time. unless you do not have a bank account That's not outsourced, that's direct, person to bank, the person has a choice, chooses to place her trust in that bank. Also, it is limited to defined things that are required, can't be done by the person, and bolstered by real backing such as FIDC. When you suggest it's probably best we trust authorities that is CA-playbook crapola meaning you must trust the authorities that have been picked for you. The vector has been reversed, people are told what has to happen, so there is no trust. Trust derives from choice. Where is the choice? iang On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com mailto:jam...@echeque.com mailto:jam...@echeque.com mailto:jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. _ cryptography mailing list cryptography@randombit.net mailto:cryptography@randombit.net mailto:cryptography@randombit.net mailto:cryptography@randombit.net http://lists.randombit.net/__mailman/listinfo/cryptography http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net mailto:cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net mailto:cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
On Mon, Apr 28, 2014 at 8:20 PM, Ryan Carboni rya...@gmail.com wrote: One can always start with the difficult first step of uninstalling certificate authorities you do not trust. Opera will autorepair damage to the certificate repository, a missing Certificate Authority is considered damage. Opera ships with a list of frequently used certificates, and if any of these are missing they will be added the next time the repository is read from disk. Other certificates will be added from the online repository as needed. - http://my.opera.com/community/forums/topic.dml?id=1580452 Its not just Opera. Others are using similar innovative methods to reduce the support load and costs. Jeff On Mon, Apr 28, 2014 at 4:42 PM, ianG i...@iang.org wrote: On 29/04/2014 00:12 am, Ryan Carboni wrote: trust is outsourced all the time in the non-cryptographic world trust is built up all the time, risks are taken all the time, choice is taken all the time. unless you do not have a bank account That's not outsourced, that's direct, person to bank, the person has a choice, chooses to place her trust in that bank. Also, it is limited to defined things that are required, can't be done by the person, and bolstered by real backing such as FIDC. When you suggest it's probably best we trust authorities that is CA-playbook crapola meaning you must trust the authorities that have been picked for you. The vector has been reversed, people are told what has to happen, so there is no trust. Trust derives from choice. Where is the choice? On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com mailto:jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] Request - PKI/CA History Lesson
If browsers are defeating the purpose of the chain of trust, by forcing trust in this example, why design them to freak out when a site self signs? On Apr 28, 2014 6:32 PM, Jeffrey Walton noloa...@gmail.com wrote: On Mon, Apr 28, 2014 at 8:20 PM, Ryan Carboni rya...@gmail.com wrote: One can always start with the difficult first step of uninstalling certificate authorities you do not trust. Opera will autorepair damage to the certificate repository, a missing Certificate Authority is considered damage. Opera ships with a list of frequently used certificates, and if any of these are missing they will be added the next time the repository is read from disk. Other certificates will be added from the online repository as needed. - http://my.opera.com/community/forums/topic.dml?id=1580452 Its not just Opera. Others are using similar innovative methods to reduce the support load and costs. Jeff On Mon, Apr 28, 2014 at 4:42 PM, ianG i...@iang.org wrote: On 29/04/2014 00:12 am, Ryan Carboni wrote: trust is outsourced all the time in the non-cryptographic world trust is built up all the time, risks are taken all the time, choice is taken all the time. unless you do not have a bank account That's not outsourced, that's direct, person to bank, the person has a choice, chooses to place her trust in that bank. Also, it is limited to defined things that are required, can't be done by the person, and bolstered by real backing such as FIDC. When you suggest it's probably best we trust authorities that is CA-playbook crapola meaning you must trust the authorities that have been picked for you. The vector has been reversed, people are told what has to happen, so there is no trust. Trust derives from choice. Where is the choice? On Mon, Apr 28, 2014 at 3:00 PM, James A. Donald jam...@echeque.com mailto:jam...@echeque.com wrote: On 2014-04-29 05:58, Ryan Carboni wrote: We happen to live on a planet where most users are ordinary users. given the extent of phishing, it's probably best we outsource trust to centralized authorities. Although it should be easier establishing your own certificate authority. Cannot outsource trust Ann usually knows more about Bob than a distant authority does. A certificate authority does not certify that Bob is trustworthy, but that his name is Bob. In practice, however we find that diverse entities have very similar names, and a single entity may have many names. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
