Never going to get tired of self-identified libertarians making statements about moral obligations.
You have a moral obligation to use crypto
11–20 of 92 posts
Re: You have a moral obligation to use crypto
#12'crypto', because typing 'cryptography' is too hard. This and 'cyber' grind my gears. Specially when politicians/opinion makers throw the terms around without really understanding what they mean.
Do "memo" and "pub" irritate you as well?
Re: You have a moral obligation to use crypto
#13Safari can't verify the identity of the website "blog.easydns.org". The certificate for this website is invalid. You might be connecting to a website that is pretending to be "blog.easydns.org", which could put your confidential information at risk. Would you like to connect to the website anyway?
As usual, misconfiguration causing scary warnings, useless to the end user, but the connection is still encrypted. I really wish we'd divorce the identity assurance part of PKI from the encryption part. I have no idea how it would be done, but.
Moxie introduced http://www.convergence.io/ a while ago now (https://www.youtube.com/watch?v=8N4sb-SEpcg), which could offer significant advantages over the PKI if it became widely adopted. Although it's not an end-all solution to identity, it's a step in the right direction (using web-of-trust ideas).
Re: You have a moral obligation to use crypto
#14Earlier quoted context omitted.
You can but you'd need to convince browser vendors to add your CA to their list of trusted CA's in order to get rid of the security warning.
Can you add a CA to firefox manually yourself? It looks like you can.
You can, you can also add a CA to all operating systems as well.
Re: You have a moral obligation to use crypto
#15Re: You have a moral obligation to use crypto
#16Earlier quoted context omitted.
You can but you'd need to convince browser vendors to add your CA to their list of trusted CA's in order to get rid of the security warning.
Can you add a CA to firefox manually yourself? It looks like you can.
Adding a single root to locally installed copies of a web browser is only really useful for 2 things: testing an SSL configuration for development, and deploying your own CA to all computers on an intranet to so you can MITM their traffic without throwing up warnings.
For a bit of fun, compare the warnings about a self-signed certificate in Firefox with those triggered by attempting to download a self-signed certificate with the CA:true bit set.
Re: You have a moral obligation to use crypto
#17Earlier quoted context omitted.
Can you add a CA to firefox manually yourself? It looks like you can.
Adding a single root to locally installed copies of a web browser is only really useful for 2 things: testing an SSL configuration for development, and deploying your own CA to all computers on an intranet to so you can MITM their traffic without throwing up warnings. For a bit of fun, compare the warnings about a self-signed certificate in Firefox with those triggered by attempting to download a self-signed certific…
So this single root ploy is what large companies do to MITM their employees at work, I assume.
I'll have to investigate what you suggest I do for fun, because I haven't tinkered with these certs before. What flags do you pass to openssl?
The certificates do specify the issuer though. So you could use a self run CA in the manual arrangement to verify that your connection isn't being MITM'd, assuming you don't lose control of your self run CA, or leak its private key. Correct me if I am wrong.
Re: You have a moral obligation to use crypto
#18Earlier quoted context omitted.
Encryption without identity assurance really doesn't mean anything though--one might be a victim of a MITM attack. The issue is that XPKI is _really_ easy to get wrong, but there are alternatives.
What are the alternatives?
SPKI (http://en.wikipedia.org/wiki/Simple_public-key_infrastructur...) is a great one. The guys behind it really thought hard about what a PKI should do, and what it can do, and what a relying party can actually rely on.
Contrary to the Wikipedia page, there's a potential role for CAs. As an example, a CA could still sell a certificate authorising a key to, say, serve HTTPS data for the site foo.com; that key could then delegate authority for bar.foo.com, for www.foo.com and whatever else, without needing to go back cap-in-hand to the original CA.
Among the cool things is that a CA trusted to vouch for people serving data in .com wouldn't necessarily be trusted to serve data for .co.uk. One might have CAs vouching for one's ownership of IP addresses.
All of this was simple and straightforward, with a clean model (unlike the XPKI mess which conflates identity and authorisation), so of course it failed utterly.
Re: You have a moral obligation to use crypto
#19Safari can't verify the identity of the website "blog.easydns.org". The certificate for this website is invalid. You might be connecting to a website that is pretending to be "blog.easydns.org", which could put your confidential information at risk. Would you like to connect to the website anyway?
As usual, misconfiguration causing scary warnings, useless to the end user, but the connection is still encrypted. I really wish we'd divorce the identity assurance part of PKI from the encryption part. I have no idea how it would be done, but.
Namecoin
Re: You have a moral obligation to use crypto
#20The Internet services who are complaining should start coding, instead, or in addition to complaining. Secure key exchange, secure real time communication, secure storage, and secure email payload would blind the surveillance state. All surveillance states.
Even if you think your own surveillance state is less than harmful, there are dozens of others which are patently evil or thoroughly corrupt. And yet, while we do business all over the planet, even business cloud services are almost all unencrypted.
Meeting this moral obligation is something Yahoo, Google, and others could make much easier. At some point, we have to ask why not?