Not that SSL certificates are worth the paper they aren't printed
on; I still find this vaguely disturbing. Just who do you think your
computer is trusting?
http://www.websheji.com/domain-names/news/id506.html
Bob Parsons, CEO of Go Daddy, said that Starfield Technologies, a
subsidiary of the company, bought an unused root certificate, trusted by
99% percent of the browsers from ValiCert Inc more than a year ago has
been developing the system since then.
I'm not that interested in SSL for web servers, but I have noticed a
gradual increase in the number of mail servers willing to STARTTLS with
mine. I was experimenting with trying to verify some of the certificates
presented, its not real security, but makes the logs cleaner.
Sean Donelan <sean@donelan.com> writes:
I'm not that interested in SSL for web servers, but I have noticed a
gradual increase in the number of mail servers willing to STARTTLS with
mine. I was experimenting with trying to verify some of the certificates
presented, its not real security, but makes the logs cleaner.
Most of us who are willing to opportunistically do STARTTLS are using
self-signed certificates anyway. We do this for many reasons; chief
among the reasons I do so are:
1) More encrypted traffic running around the Internet is a _good thing_
2) Even if the contents of my email is PGP-encrypted, headers and
transactions can still be passively monitored and collected. This is
sufficient for drawing relationship graphs. Opportunistic TLS fixes
this problem.
Note that "verifying the identity of the guy on the other end and thus
eliminating man-in-the-middle attacks on my email" is not on the list.
STARTTLS-capable MTAs vary in their ability to follow certificate
chains anyway...
---Rob
Thus spake "Robert E. Seastrom" <rs@seastrom.com>
Most of us who are willing to opportunistically do STARTTLS are using
self-signed certificates anyway. We do this for many reasons; chief
among the reasons I do so are:
1) More encrypted traffic running around the Internet is a _good thing_
This is an oft-overlooked angle... If only sensitive information is
encrypted, then the mere use of encryption makes one a target -- one buys a
safe only if they have valuables to protect, right? However, if every home
came with a safe, how would burglars figure out who to rob?
The feds clearly have the power to get through or around encryption
suspected criminals are using: the FBI reports that there have been _zero_
cases nationwide over the past several years where the use of encryption has
prevented them or other agencies from obtaining the evidence needed, even
when "secure" tools like PGP, SSL, or IPsec are used. Unfortunately, one
must then assume that other, less honest parties have the same success rate,
and so the only defense is to make it impossible to determine _which_
traffic to decrypt and even who is talking to whom.
S
Stephen Sprunk "Stupid people surround themselves with smart
CCIE #3723 people. Smart people surround themselves with
K5SSS smart people who disagree with them." --Aaron Sorkin
<snip>
That assumes the FBI can be trusted to be honest about cases where encryption
successfully foiled their investigations. It is in their best interest, after
all, to have everyone, criminals included, think encryption is not worth
using (_especially_ if it is). 
OTOH, the average criminal is probably about as smart as the average user,
which means the FBI wouldn't have to break the crypto, when they could just
guess the criminal's passphrase/password with a minimum of effort ...
(that said, I absolutely agree that more crypto everywhere, for both
important and trivial traffic, is essential to reducing the "unusual" nature
of such traffic. Crypto should be the default, not the exception.)
</wishful thinking>
I have a hard time believing this...
So what do they do? Send a team in to retrieve the key from your system? Borrow some CPU time from the NSA?
They secretly enter your house and put a hardware monitor on your keyboard to collect your passphrase as you type it in.
http://www.wired.com/news/privacy/0,1848,49455,00.html
If you use the NSA, then you can't prosecute. The NSA won't testify in court, because they won't divulge what their true capabilities are.
So, you only use the NSA when the knowledge is more important than being able to prosecute.
Maybe this will cut down on unemployment a little:
The Watergate burglars now have job opportunities
Have to read those stats *very* carefully. What the FBI report actually
*says* is that there were zero cases where they didn't eventually get
the information they were looking for. That's a very clever use of spin control.
Remember - in the Scarfo case, they eventually got the info - after resorting
to multiple black-bag jobs. I'm sure there were other cases where they got the
info via bribery, informants, and plea-bargains, and I'd be very surprised if
there were zero cases of rubber-hose crypto.
Yes, a *very* well funded and determined adversary can beat crypto (almost
always by doing an end run around it). However, raising the bar to that level
will eliminate all the successful attacks by lesser adversaries, and can also
contribute to the bankrupting of the well-funded - even the FBI can afford only
a few Scarfo-scale cases a year...
Thus spake "Iljitsch van Beijnum" <iljitsch@muada.com>
> The feds clearly have the power to get through or around encryption
> suspected criminals are using: the FBI reports that there have been
> _zero_ cases nationwide over the past several years where the use of
> encryption has prevented them or other agencies from obtaining the
> evidence needed, even when "secure" tools like PGP, SSL, or IPsec
> are used.
I have a hard time believing this...
The DOJ was directed by Congress to collect data and report back each year,
and while I don't trust any law-enforcement types in general, I do trust in
their fear of Congressional inquiries. Besides, given the FBI's past
position on crypto, especially key escrow, I have a hard time believing
they'd claim crypto wasn't a problem if it actually was -- that's
counter-productive for them.
So what do they do? Send a team in to retrieve the key from your
system? Borrow some CPU time from the NSA?
The reasons for the FBI's conclusion were not given. It's "common
knowledge" that it's cheaper to attack the key-management systems (or the
end systems) than the crypto, so that's one possibility. Another is that
the existing implementations are flawed in ways that reveal the keys and/or
plaintext. Last, it's possible that the plaintext was never recovered and
the pattern of communication was enough evidence in itself.
S
Stephen Sprunk "Stupid people surround themselves with smart
CCIE #3723 people. Smart people surround themselves with
K5SSS smart people who disagree with them." --Aaron Sorkin