<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Oct 3, 2014, at 2:03 PM, Joseph Bonneau <<a href="mailto:jbonneau@gmail.com">jbonneau@gmail.com</a>> wrote:<div><blockquote type="cite"><div dir="ltr"><p dir="ltr">On Oct 3, 2014 9:54 PM, "elijah" <<a href="mailto:elijah@riseup.net" target="_blank">elijah@riseup.net</a>> wrote:<br>><br>> On 10/03/2014 11:54 AM, Tao Effect wrote:<br>> > On Oct 3, 2014, at 11:43 AM, elijah <<a href="mailto:elijah@riseup.net" target="_blank">elijah@riseup.net</a>><br>><br>> Your scenario, afaik, is an attacker who can mitm any and all network<br>> connections and so can inject bad data in the gossip among monitors and<br>> the connections between user-agents-auditors and monitors. To me, this<br>> assumes that this global mitm attack has existed for all time, since<br>> once a user agent or a monitor is able to initially bootstrap some<br>> correctly authenticated secure connection with a monitor, they should be<br>> able to detect subsequent mitm attempts from that point forward.<br><br>Agreed. The threat model assumed in Greg's blog post about CT isn't quite stated explicitly but it feels absurdly strong to the point of being a red herring.</p></div></blockquote><div><br class="webkit-block-placeholder"></div><div>It's also a mistaken understanding of the original attack, and ignores the update made to the post on September 27th, which points out that for clients who are gossiping, CT's proofs don't even detect today's basic types of HTTPS attacks (simple mis-issuance).</div><div><br class="webkit-block-placeholder"></div><div>Sorry, I need to finish lunch and rest. Then I will give a complete response to your and elijah's emails (and an off-list reply I received).</div><div><br></div><div>Just wanted to quickly point this out before even more people walk away with a misunderstanding of the attacks.</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></div></body></html>