📅 Original date posted:2013-10-28
📝 Original message:On Mon, Oct 28, 2013 at 1:14 PM, Adam Back <adam at cypherspace.org> wrote:
> Maybe I voice this opinion a bit late in the cycle, but ....
A bit late is one way to put it. All these topics and more were discussed
to death a year ago when the payment protocol was first being designed.
Bluntly, I think we're all sick of it. You are welcome to PGP sign your
payment requests if you want to. If not, then please see my FAQ for
discussion:
https://bitcointalk.org/index.php?topic=300809.msg3225143#msg3225143
tl;dr - the right way to tackle governments getting bogus certs issued is
certificate transparency. All other suggestions tend to boil down to
"here's some handwaving that doesn't actually solve the problem".
By the way, the evidence from the Snowden case rather reinforces the
strength of the CA system. Did we see stories about bulk usage of fake
certificates? No. What we read is that the increased usage of SSL was a
major game-changer for intelligence agencies. They "solve" SSL by compiling
databases of private keys they obtain in various ways. True to form when
the FBI wanted access to LavaBit, they tried to obtain his private keys
rather than just push a convenient "give me a fake cert" button, and when
it became known that Lavabit had to hand over their key, GoDaddy revoked
their certificate. Industry policies forced their hand and those policies
don't have a get-out clause for the FBI.
It's without a doubt that there are government-issued fake certs floating
about, somewhere, just due to the scale of hacking that's been taking
place. However, demanding perfection in a system that handles security for
over a billion people and tens of millions of operators is unreasonable.
All we can ask for is that it it's being improved, which through
initiatives like cert transparency, it is.
Please, let's call time on these discussions. They long ago ceased to have
any value.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131028/5039010f/attachment.html>;
Mike Hearn [ARCHIVE] /
npub17t…4qgyd
2023-06-07 15:08:18
in reply to nevent1q…gg25
Author Public Key
npub17ty4mumkv43w8wtt0xsz2jypck0gvw0j8xrcg6tpea25z2nh7meqf4qgydPublished at
2023-06-07 15:08:18Event JSON
{
"id": "29581259719892ad1b4659c6293b617a5bce7d2cc776c3f97f3dcaa827e69e6f",
"pubkey": "f2c95df3766562e3b96b79a0254881c59e8639f23987846961cf55412a77f6f2",
"created_at": 1686150498,
"kind": 1,
"tags": [
[
"e",
"742033471721f40b6d43cf4cd64612772c20a2675cdda10846c302155fc1bb24",
"",
"root"
],
[
"e",
"a87287ffcb124b0b11f9b767302a2093a53bdbd2d3cfce79998cd7a7d5f9e2dd",
"",
"reply"
],
[
"p",
"ee0fa66772f633411e4432e251cfb15b1c0fe8cd8befd8b0d86eb302402a8b4a"
]
],
"content": "📅 Original date posted:2013-10-28\n📝 Original message:On Mon, Oct 28, 2013 at 1:14 PM, Adam Back \u003cadam at cypherspace.org\u003e wrote:\n\n\u003e Maybe I voice this opinion a bit late in the cycle, but ....\n\n\nA bit late is one way to put it. All these topics and more were discussed\nto death a year ago when the payment protocol was first being designed.\nBluntly, I think we're all sick of it. You are welcome to PGP sign your\npayment requests if you want to. If not, then please see my FAQ for\ndiscussion:\n\n https://bitcointalk.org/index.php?topic=300809.msg3225143#msg3225143\n\ntl;dr - the right way to tackle governments getting bogus certs issued is\ncertificate transparency. All other suggestions tend to boil down to\n\"here's some handwaving that doesn't actually solve the problem\".\n\nBy the way, the evidence from the Snowden case rather reinforces the\nstrength of the CA system. Did we see stories about bulk usage of fake\ncertificates? No. What we read is that the increased usage of SSL was a\nmajor game-changer for intelligence agencies. They \"solve\" SSL by compiling\ndatabases of private keys they obtain in various ways. True to form when\nthe FBI wanted access to LavaBit, they tried to obtain his private keys\nrather than just push a convenient \"give me a fake cert\" button, and when\nit became known that Lavabit had to hand over their key, GoDaddy revoked\ntheir certificate. Industry policies forced their hand and those policies\ndon't have a get-out clause for the FBI.\n\nIt's without a doubt that there are government-issued fake certs floating\nabout, somewhere, just due to the scale of hacking that's been taking\nplace. However, demanding perfection in a system that handles security for\nover a billion people and tens of millions of operators is unreasonable.\nAll we can ask for is that it it's being improved, which through\ninitiatives like cert transparency, it is.\n\nPlease, let's call time on these discussions. They long ago ceased to have\nany value.\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131028/5039010f/attachment.html\u003e",
"sig": "58036cc093aed875122c5c98c88923abaa1b4f7b09a2fa33028459fafb4c187984287f29ee0699e43f7fd5c29d94f3e6f8ecd07f0957e630be9b1b7c4d968eb3"
}