TLS/SSL Survey (Ristic/Qualsys) (was: Re: A mighty fortress is our PKI)

2010-08-04 Thread =JeffH
Internet SSL Survey 2010 is here! (blog post) http://blog.ivanristic.com/2010/07/internet-ssl-survey-2010-is-here.html Actual report: Qualys Internet SSL Survey 2010 v1.6 (PDF, 3.2 MB) http://blog.ivanristic.com/Qualys_SSL_Labs-State_of_SSL_2010-v1.6.pdf =JeffH

Re: GSM eavesdropping

2010-08-04 Thread Jerry Leichter
On Aug 2, 2010, at 4:19 PM, Paul Wouters wrote: ...Of course, TLS hasn't been successful in the sense that we care about most. TLS has had no impact on how users authenticate (we still send usernames and passwords) to servers, and the way TLS authenticates servers to users turns out to be

Re: Is this the first ever practically-deployed use of a threshold scheme?

2010-08-04 Thread Tanja Lange
There is more than the UI at stake here, i.e. the basic functionality of the scheme. Say you distribute shares in a 4 out of 7 scheme (ABCDEF) and share A is published on the web. How do you recover from the remaining 3 out of 6 scheme into a 4 out of 6 scheme without having a key

Re: Is this the first ever practically-deployed use of a threshold scheme?

2010-08-04 Thread Thierry Moreau
Tanja Lange wrote: There is more than the UI at stake here, i.e. the basic functionality of the scheme. Say you distribute shares in a 4 out of 7 scheme (ABCDEF) and share A is published on the web. How do you recover from the remaining 3 out of 6 scheme into a 4 out of 6 scheme without having

Re: A mighty fortress is our PKI, Part II

2010-08-04 Thread Anne Lynn Wheeler
Kaspersky: Sham Certificates Pose Big Problem for Windows Security http://www.ecommercetimes.com/story/70553.html from above .. Windows fails to clearly indicate when digital security certificates have been tampered with, according to Kaspersky Lab's Roel Schouwenberg, and that opens a door for

EFF/iSEC's SSL Observatory slides available

2010-08-04 Thread Chris Palmer
http://www.eff.org/observatory We have downloaded a dataset of all of the publicly-visible SSL certificates, and will be making that data available to the research community in the near future. So, keep an eye on that page. The data is very useful. Many more interesting conclusions remain to be

Re: EFF/iSEC's SSL Observatory slides available

2010-08-04 Thread Chris Palmer
They tell me they will be releasing the data both raw and as a MySQL database, so you can learn interesting things just by writing SQL queries. So, keep an eye on that page. The data is very useful. Many more interesting conclusions remain to be drawn from the data; once it's out (I'm told

Re: A mighty fortress is our PKI, Part II

2010-08-04 Thread David-Sarah Hopwood
Anne Lynn Wheeler wrote: Kaspersky: Sham Certificates Pose Big Problem for Windows Security http://www.ecommercetimes.com/story/70553.html from above .. Windows fails to clearly indicate when digital security certificates have been tampered with, according to Kaspersky Lab's Roel