Re: [cryptography] Anyone seen this CA before?

2012-03-31 Thread Peter Gutmann
Jon Callas writes: >That's hilarious! I love it! But I see some security problems: > >[...] One final one: There's no (implied) guarantee that any money changed hands. How can I trust a CA certificate if no-one paid for it? This destroys the very foundations of commercial PKI and the high lev

Re: [cryptography] Anyone seen this CA before?

2012-03-31 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mar 31, 2012, at 7:38 PM, Marsh Ray wrote: > > Has anyone seen this CA before? > > Sounds like an interesting business model, even if the site design looks a > bit anachronistic. > > http://print-a-cert.com/ > That's hilarious! I love it! Bu

[cryptography] Anyone seen this CA before?

2012-03-31 Thread Marsh Ray
Has anyone seen this CA before? Sounds like an interesting business model, even if the site design looks a bit anachronistic. http://print-a-cert.com/ - Marsh ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mail

Re: [cryptography] crypto.cat

2012-03-31 Thread James A. Donald
On 2012-04-01 7:51 AM, natanae...@gmail.com wrote: It's running in a browser using JS... To attack JS, the attacker needs to induce the victim to open the attackers web page at the same time as the attacked web page, and successfully apply a cross site scripting attack. The simplicity of the

Re: [cryptography] crypto.cat

2012-03-31 Thread natanael . l
It's running in a browser using JS... 2012-03-31 23:33 skrev Nadim: This strikes me as a sizeable assumption. NK On Saturday, 31 March, 2012 at 5:28 PM, natanae...@gmail.com wrote: And javascript controls how it is used. Modify or add some JS and you can take the key. 2012-03-31 22:56 skr

Re: [cryptography] crypto.cat

2012-03-31 Thread Nadim
This strikes me as a sizeable assumption. NK On Saturday, 31 March, 2012 at 5:28 PM, natanae...@gmail.com wrote: > > And javascript controls how it is used. Modify or add some JS and you can > take the key. > > > > 2012-03-31 22:56 skrev James A. Donald: > On 2012-04-01 6:17 AM, natanae..

Re: [cryptography] crypto.cat

2012-03-31 Thread natanael . l
And javascript controls how it is used. Modify or add some JS and you can take the key. 2012-03-31 22:56 skrev James A. Donald: On 2012-04-01 6:17 AM, natanae...@gmail.com wrote: > There are two issues IMHO: > > * SSL flaws/Javascript MITM/bad servers. Your key can be leaked. According to the

Re: [cryptography] crypto.cat

2012-03-31 Thread James A. Donald
On 2012-04-01 6:17 AM, natanae...@gmail.com wrote: There are two issues IMHO: * SSL flaws/Javascript MITM/bad servers. Your key can be leaked. According to the spec, your key remains on your browser. So cannot be leaked unless your computer has been got at. ___

Re: [cryptography] crypto.cat

2012-03-31 Thread James A. Donald
On 2012-03-31 11:49 PM, Mario Contestabile wrote: You guys have any cypherpunk opinions on https://crypto.cat/ ? It's a "secure" online communication tool, apparently used by Anonymous. It was developed by Nadim Kobeissi, (yet another Montrealer). Mario Public source, standard algorithms, do

Re: [cryptography] crypto.cat

2012-03-31 Thread natanael . l
There are two issues IMHO: * SSL flaws/Javascript MITM/bad servers. Your key can be leaked. * If you already have a way to verify fingerprint PER SESSION, then why use this service? I can only imagine it's because you prefer to type on a computer keyboard on a public access computer than on you

Re: [cryptography] crypto.cat

2012-03-31 Thread Jacob Taylor
It seems that isn't true: https://crypto.cat/about/spec-rev1.2c.pdf (Section 6 in particular) Nadim's response via twitter (until he can get the list working) https://twitter.com/#!/kaepora/status/186130431048036352 "Just subscribed, can't seem to reply. It does actually have authentication via f

Re: [cryptography] crypto.cat

2012-03-31 Thread natanael . l
It seems to lack verification and authorization = easy to MITM. 2012-03-31 15:49 skrev Mario Contestabile: You guys have any cypherpunk opinions on https://crypto.cat/ ? It's a "secure" online communication tool, apparently used by Anonymous. It was developed by Nadim Kobeissi, (yet another

[cryptography] crypto.cat

2012-03-31 Thread Mario Contestabile
You guys have any cypherpunk opinions on https://crypto.cat/ ? It's a "secure" online communication tool, apparently used by Anonymous. It was developed by Nadim Kobeissi, (yet another Montrealer). Mario ___ cryptography mailing list cryptography@rand

Re: [cryptography] Detecting Crypto Compromises

2012-03-31 Thread Eitan Adler
On 30 March 2012 22:23, Landon Hurley wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Does anyone have any knowledge of academic papers focused on methods > of detecting whether a crypto scheme has been compromised in situ or > on how to utilize intelligence gleaned from compromised

Re: [cryptography] Key escrow 2012

2012-03-31 Thread Peter Gutmann
StealthMonger writes: >If we had won, crypto would be in widespread use today for email. As it is, >enough FUD and confusion was sown to avert that outcome. Even on geek >mailing lists such as this, signatures are rare. That's because they serve little purpose and the tools are wy too hard