[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAA7UWsW7jo9fE3NTv7QbRLHt33BpBPyuwX_b_2fU2P+Ce+P5ZQ@mail.gmail.com>
Date: Fri, 10 Oct 2014 15:15:46 -0400
From: David Leon Gil <coruus@...il.com>
To: Kristian Fiskerstrand <kristian.fiskerstrand@...ptuouscapital.com>
Cc: Daniel Kahn Gillmor <dkg@...thhorseman.net>, oss-security@...ts.openwall.com,
"gnupg-devel@...pg.org" <gnupg-devel@...pg.org>, Werner Koch <wk@...pg.org>, thijs@...ian.org
Subject: Re: HKPS [was 0xdeadbeef]
So this doesn't get lost: I'm convinced by dkg and Kristian's
arguments: Use hkps with hkps.pool.sks-keyservers.net
GnuPG 2.1 will ship with hkps enabled by default, I believe, and
Kristian's CA. (I don't think 2.0 does yet.)
On Fri, Oct 10, 2014 at 12:27 PM, Kristian Fiskerstrand
<kristian.fiskerstrand@...ptuouscapital.com> wrote:
> You are quite correct that I probably wouldn't, and my primary income
> is from another industry, but at the same time that does bring a
> protection as I wouldn't be discouraged to fight any oppression.
I do agree about that.
And, in fact: I failed to thank you! I've used the SKS pool you
operate for many years. You provide a critical public service.
> Although for the root
> CAs the major problem is simply the amount of CAs accepted by standard
> implementations, several of which are run by various governments. In
> the end it comes down to what the threat model is and whom you're
> protecting yourself from.
Very much agreed; my particular threat model for this *isn't*
protection against the NSA. (Aside from perhaps protection from
traffic analysis.) It's protection against much weaker threats.
> Currently the only criteria for whether someone gets a certificate for
> a server in the pool is based on technical merits . . .
One thing that one can do (which I do when I don't have a copy of a
key in one of my local keydumps) is use the strategy of Tor's
"tlsdate": use a set of servers which are unlikely to be controlled by
the same adversary.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
