📅 Original date posted:2013-05-14
📝 Original message:On 14 May 2013 20:41, Peter Todd <pete at petertodd.org> wrote:
> report: https://bitcointalk.org/index.php?topic=205349.0
>
> Every talk will be widely witnessed and videotaped so we can get some
> reasonably good security by simply putting out PGP fingerprints in our
> slides. Yeah, some fancy attacker could change the videos after the
> fact, but the talks themselves will have wide audiences and a lot of
> opportunities for fraud to be discovered. That means it'd also be
> reasonable for people to sign those keys too if you are present and are
> convinced you aren't looking at some impostor. (of course, presenters,
> check that your PGP fingerprints are correct...)
>
>
> Remember that PGP depends on the web-of-trust. No single measure in a
> web-of-trust is needs to be absolutely perfect; it's the sum of the
> verifications that matter. I don't think it matters much if you have,
> say, seen Jeff Garzik's drivers license as much as it matters that you
> have seen him in a public place with dozens of witnesses that would
> recognize him and call out any attempt at fraud.
>
> Secondly remember that many of us are working on software where an
> attacker can steal from huge numbers of users at once if they manage to
> sneak some wallet stealing code in. We need better code signing
> practices, but they don't help without some way of being sure the keys
> signing the code are valid. SSL and certificate authorities have
> advantages, and so does the PGP WoT, so use both.
>
>
> FWIW I take this stuff pretty seriously myself. I generated my key
> securely in the first place, I use a hardware smartcard to store my PGP
> key, and I keep the master signing key - the key with the ability to
> sign other keys - separate from my day-to-day signing subkeys. I also
> PGP sign emails regularly, which means anyone can get a decent idea of
> if they have the right key by looking at bitcoin-development mailing
> list archives and checking the signatures. A truly dedicated attacker
> could probably sign something without my knowledge, but I've certainly
> raised the bar.
>
Just out of curiosity, could PGP keyservers suffer from a similar 51%
attack as the bitcoin network?
>
> --
> 'peter'[:-1]@petertodd.org
> 000000000000016be577c0f0ce4c04a05fdbfc8e0b6f69053659f32aeea3a518
>
>
> ------------------------------------------------------------------------------
> AlienVault Unified Security Management (USM) platform delivers complete
> security visibility with the essential security capabilities. Easily and
> efficiently configure, manage, and operate all of your security controls
> from a single console and one unified framework. Download a free trial.
> http://p.sf.net/sfu/alienvault_d2d
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130514/17d09b72/attachment.html>;
Melvin Carvalho [ARCHIVE] /
npub1uv…saxrt
2023-06-07 15:01:58
in reply to nevent1q…8khy
Author Public Key
npub1uvtfvcegcn9kds68r8he57emc480vqtx8t22kpsctxgjxae44gvsksaxrtPublished at
2023-06-07 15:01:58Event JSON
{
"id": "e147f68fb79061779bd640fd5d17375156cf6ad157edb0172f8c2243392044ee",
"pubkey": "e316966328c4cb66c34719ef9a7b3bc54ef601663ad4ab06185991237735aa19",
"created_at": 1686150118,
"kind": 1,
"tags": [
[
"e",
"d4362c2579a3b89d4d5eaa7b140b6f66760c6321f0a54e42c9458589e6b73817",
"",
"root"
],
[
"e",
"72ef8608d3d4f1a0e12b69ee8c72e3f15885450c5ee29b45ce341fadf5fa4e9b",
"",
"reply"
],
[
"p",
"daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa"
]
],
"content": "📅 Original date posted:2013-05-14\n📝 Original message:On 14 May 2013 20:41, Peter Todd \u003cpete at petertodd.org\u003e wrote:\n\n\u003e report: https://bitcointalk.org/index.php?topic=205349.0\n\u003e\n\u003e Every talk will be widely witnessed and videotaped so we can get some\n\u003e reasonably good security by simply putting out PGP fingerprints in our\n\u003e slides. Yeah, some fancy attacker could change the videos after the\n\u003e fact, but the talks themselves will have wide audiences and a lot of\n\u003e opportunities for fraud to be discovered. That means it'd also be\n\u003e reasonable for people to sign those keys too if you are present and are\n\u003e convinced you aren't looking at some impostor. (of course, presenters,\n\u003e check that your PGP fingerprints are correct...)\n\u003e\n\u003e\n\u003e Remember that PGP depends on the web-of-trust. No single measure in a\n\u003e web-of-trust is needs to be absolutely perfect; it's the sum of the\n\u003e verifications that matter. I don't think it matters much if you have,\n\u003e say, seen Jeff Garzik's drivers license as much as it matters that you\n\u003e have seen him in a public place with dozens of witnesses that would\n\u003e recognize him and call out any attempt at fraud.\n\u003e\n\u003e Secondly remember that many of us are working on software where an\n\u003e attacker can steal from huge numbers of users at once if they manage to\n\u003e sneak some wallet stealing code in. We need better code signing\n\u003e practices, but they don't help without some way of being sure the keys\n\u003e signing the code are valid. SSL and certificate authorities have\n\u003e advantages, and so does the PGP WoT, so use both.\n\u003e\n\u003e\n\u003e FWIW I take this stuff pretty seriously myself. I generated my key\n\u003e securely in the first place, I use a hardware smartcard to store my PGP\n\u003e key, and I keep the master signing key - the key with the ability to\n\u003e sign other keys - separate from my day-to-day signing subkeys. I also\n\u003e PGP sign emails regularly, which means anyone can get a decent idea of\n\u003e if they have the right key by looking at bitcoin-development mailing\n\u003e list archives and checking the signatures. A truly dedicated attacker\n\u003e could probably sign something without my knowledge, but I've certainly\n\u003e raised the bar.\n\u003e\n\nJust out of curiosity, could PGP keyservers suffer from a similar 51%\nattack as the bitcoin network?\n\n\n\u003e\n\u003e --\n\u003e 'peter'[:-1]@petertodd.org\n\u003e 000000000000016be577c0f0ce4c04a05fdbfc8e0b6f69053659f32aeea3a518\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e AlienVault Unified Security Management (USM) platform delivers complete\n\u003e security visibility with the essential security capabilities. Easily and\n\u003e efficiently configure, manage, and operate all of your security controls\n\u003e from a single console and one unified framework. Download a free trial.\n\u003e http://p.sf.net/sfu/alienvault_d2d\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130514/17d09b72/attachment.html\u003e",
"sig": "9b05f12be4503b3c4c6629d1d773a4acdb1226b030dcae2363cfe26a10258736018e620de354a800fbf2f9e3f4aa836390705dadfe1de77729918fbb7be0ba3b"
}