<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi Tony,<div><br></div><div><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">but are fingerprints even a good idea?</div></div></div></blockquote><div><br></div>I don't think so, and they are not necessary for the most part.</div><div><br></div><div>I'm working on a way to bring down the number of fingerprint checks to zero (for most people), and one (for those who can understand the concept).</div><div><br></div><div>This is accomplished by using blockchains to distribute public key fingerprints.</div><div><br></div><div>There is a working implementation of this called DNSChain (one of the projects that I'm working on):</div><div><br></div><div><a href="http://github.com/okTurtles/dnschain">http://github.com/okTurtles/dnschain</a></div><div><br></div><div>DNSChain makes it possible to check a fingerprint (for the DNSChain server) once, and from then on never worry about it again.</div><div><br></div><div>One of the goals of DNSChain is to secure TLS from MITM attacks, and thereby secure HTTPS (and all other protocols that depend on TLS) from such attacks. Simultaneously, it greatly simplifies network security for end-users.</div><div><br></div><div>Details are on the GitHub and this blog post:</div><div><br></div><div><a href="http://blog.okturtles.com/2014/02/introducing-the-dotdns-metatld/">http://blog.okturtles.com/2014/02/introducing-the-dotdns-metatld/</a></div><div><br></div><div>Cheers,</div><div>Greg</div><div><br></div><div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br><div><div>On Mar 11, 2014, at 6:33 AM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">I feel like solutions that rely on manual verification of key fingerprints fall into this category:<div><br></div><div><a href="http://i.imgur.com/2bEWKNS.png">http://i.imgur.com/2bEWKNS.png</a><br clear="all">
<div><br></div><div>I don't think these solutions are providing effective security. I feel we need to start from the real needs of real users, and work backwards.</div><div><br></div><div>One can propose a study for optimum time-based fingerprint verification and study fingerprint accuracy, but are fingerprints even a good idea? I feel that's where you need to start with any sort of usability study.</div>
<div><br></div><div>Cryptocat's usability studies are addressing this problem. Short Authentication Strings are addressing this problem. Solutions for optimal fingerprint comparison accuracy, IMO, are ignoring the problem, and studying the wrong solution.</div>
<div><br></div><div>Thoughts?</div><span class=""><font color="#888888"><br></font></span></div></div></div>-- <br>Tony Arcieri<br>
</div>
_______________________________________________<br>Messaging mailing list<br><a href="mailto:Messaging@moderncrypto.org">Messaging@moderncrypto.org</a><br>https://moderncrypto.org/mailman/listinfo/messaging<br></blockquote></div><br></div></body></html>