<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On Aug 29, 2014, at 8:26 AM, Ben Laurie <<a href="mailto:ben@links.org">ben@links.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 28 August 2014 20:44, Tao Effect <<a href="mailto:contact@taoeffect.com">contact@taoeffect.com</a>> wrote:<br><blockquote type="cite">So, I think I was MITM attacked. [1]<br><br>I think I detected it.<br><br>I pointed it out. I presented evidence.<br></blockquote><br>I am curious about this - I reviewed the tweets, and the evidence<br>appears to be that the cert was changed at time A and you noticed the<br>change at time A + a few weeks. I didn't see any evidence that you<br>checked it between those two times...<br></blockquote><div><br></div><div>I had checked the website the day prior to those tweets. Cert change appeared a day later. That is why I was (and am still) convinced that it was a MITM attack.</div><div><br></div><div>This event serves as a real-world example of the community's reaction to MITM attacks. It highlights extreme skepticism and apathy in spite of clear evidence of a MITM attack.</div><div><br></div><div>Only major CA compromises that have affected giant companies (like Google) get press.</div><div><br></div><div>This example shows that people on this list could be MITM attacked right now, and in the unlikely event that they detected it, it may not matter much. That is why I prefer systems that prevent MITM attacks from happening in the first place, and without any ambiguity.</div><div><br></div><div>Cheers,</div><div>Greg Slepak</div><div> <br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <br><div><div><br></div></div></body></html>