oss-sec mailing list archives
Re: 0xdeadbeef comes of age: making keysteak with GnuPG
From: Daniel Kahn Gillmor <dkg () fifthhorseman net>
Date: Fri, 10 Oct 2014 12:23:57 -0400
On 10/10/2014 12:01 PM, David Leon Gil wrote:
(While I know that if a root CA were caught intentionally issuing an MitM cert for keybase.io or pgp.mit.edu would face likely delisting/bankruptcy.)
I'd like to believe that also, but i think that some of the members of the CA cartel might be "too big to fail" in the current infrastructure. There's no chance that the CA will go bankrupt if they aren't delisted (since the CA market is a lemon market), and every web site certified by the bigger CAs has an incentive to argue against that CAs' delisting (because it will break their web site). And you're still relying on the targeted keyserver operators themselves to resist malicious intrusions on their keyservers (whether via legal or financial or technical coercion). Furthermore, pointing everyone at one or two servers which may not have the capacity to withstand heavy load (or reliable uptime) runs the risk of DoS of all those users, and increases the likelihood that OpenPGP certificates simply won't get updated when those heavily-targeted machines go down. For years, a lot of people suggested pgp.mit.edu because it was well-known, short, and easy to transmit. in practice, pgp.mit.edu was often bogged down, and wasn't even brought up to a recent version of the modern keyserver implementation (sks) until sometime last year, i think. (many thanks to the current pgp.mit.edu admins, btw, who appear to be currently doing a great job and providing an often-unappreciated public service!) --dkg
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- 0xdeadbeef comes of age: making keysteak with GnuPG David Leon Gil (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG Daniel Kahn Gillmor (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG David Leon Gil (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG Daniel Kahn Gillmor (Oct 10)
- Re: Re: 0xdeadbeef comes of age: making keysteak with GnuPG Daniel Kahn Gillmor (Oct 10)
- Re: Re: 0xdeadbeef comes of age: making keysteak with GnuPG Kurt Seifried (Oct 10)
- Re: Re: 0xdeadbeef comes of age: making keysteak with GnuPG flapflap (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG David Leon Gil (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG Kristian Fiskerstrand (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG Werner Koch (Oct 10)
- Re: 0xdeadbeef comes of age: making keysteak with GnuPG Daniel Kahn Gillmor (Oct 10)