Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Through Transparency

security.googleblog.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Security Through Transparency

#11

Post by rmhrisk »

rakoo wrote: post #8

In Certificate Transparency, a CA is responsible for sharing its issued certificates to CT. In Key Transparency, anyone can register a key for an email address; they just have to arrive first. Is there any provision for preventing squatting ?

One of the differences between Key Transparency and other solutions is the role of certifying and logging have been separated. In other words, being in the directory does not mean the identity has been verified. The verification of control of an email address is the role of the certifier. Your requirements of the certifier are an application specific decision.

Re: Security Through Transparency

#12

Post by rmhrisk »

To understand the technical approach to the solution this is a good resource - https://github.com/google/key-transparency/blob/master/docs/...

This is also useful for understanding some of the core differences between CONIKS and Key Transparency - https://github.com/google/key-transparency/blob/master/docs/...

Re: Security Through Transparency

#13

Post by tscs37 »

politician wrote: post #2

The post mentioned the inadequacy of PGP. I would like to see a comparison with Keybase ( https://keybase.io ) which addresses similar problems.

CT is mostly an automagic comparison.

You don't need to do anything and you get encryption and trust and all that stuff.

While keybase is a step in the right direction, it does not make communication any more secure by default.

You still need to setup PGP and use it to benefit from keybase.io

So in essence; CT is that one step ahead of keybase.io that makes it much much more useful but keybase is still a step in the right direction.

Re: Security Through Transparency

#15

Post by politician »

tscs37 wrote: post #13
politician wrote: post #2

The post mentioned the inadequacy of PGP. I would like to see a comparison with Keybase ( https://keybase.io ) which addresses similar problems.

CT is mostly an automagic comparison. You don't need to do anything and you get encryption and trust and all that stuff. While keybase is a step in the right direction, it does not make communication any more secure by default. You still need to setup PGP and use it to benefit from keybase.io So in essence; CT is that one step ahead of keybase.io that makes it much much more useful but keybase is still a step in the…

Thanks!

Re: Security Through Transparency

#18

Post by eternalban »

geekamongus wrote: post #16
eternalban wrote: post #14

So everytime you want to communicate you ping Google's servers?

I didn't see any evidence of them suggesting that.

What are the implications of this?

    Get a /service account key/ and download the generated JSON file.

    The service account key is used to verify client OAuth tokens.
/from here:/ https://console.developers.google.com/apis/credentials

Re: Security Through Transparency

#20

Post by dadrian »

This is awesome! I was at bar with a group of security people / cryptographers during the Real World Crypto conference last week. We were discussing what we thought some of the most important security research papers from the last five years were. Everyone agreed that CONICKS (which is what Key Transparency is based on), will likely have a huge impact in the next five years or so. I'm excited to see Google finally open-sourcing their efforts in Key Transparency.
Post reply on HN