<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Aug 29, 2014, at 10:36 AM, Ben Laurie <<a href="mailto:ben@links.org">ben@links.org</a>> wrote:<div><blockquote type="cite">I haven't seen evidence that you checked the website the day prior.<br>I'm not sure how you would provide such evidence, either, but it does<br>occur to me that the tool you were using would be usefully enhanced by<br>showing when the old cert was last seen...<br></blockquote><div><br class="webkit-block-placeholder"></div><div>If I could be assured that it was worth my time, I could dredge up Time Machine backups from that period and view my firefox browsing history to provide the needed proof.</div><div><br></div><div><blockquote type="cite"><blockquote type="cite">That is why I prefer systems that prevent MITM attacks from happening<br>in the first place, and without any ambiguity.<br></blockquote><br>I don't know how to achieve that.<br></blockquote></div><div><br></div><div>Is that in reference to things like HeartBleed (private key compromise, etc.)?</div><div><br></div><div>Here's the reason why this is a false choice (if that's what you're referring to):</div><div><br></div><div>- Private key compromise / backdoors / bugs are pretty much the only way that MITM can happen with DNSChain / blockchain-based auth.</div><div><br></div><div>- Certificate Transparency allows that, plus mass-MITM (global) surveillance.</div><div><br></div><div>Preventing mass-MITM as much as possible is what I was referring to by "prevent MITM attacks from happening in the first place".</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div><div> <br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <div><div><br></div></div></div></body></html>