<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Jan 23, 2015, at 6:37 PM, U.Mutlu <<a href="mailto:for-gmane@mutluit.com">for-gmane@mutluit.com</a>> wrote:<blockquote type="cite">Why am I wrong? Where is your argument?</blockquote><div><br></div>Several people have replied to you and presented arguments which you have either ignored or misunderstood.<div><br></div><div>Michael mentioned:</div><div><i><br></i></div><div><blockquote type="cite"><i>Without PKI it’s a duckling model at best, and you don’t log into every website every time with a password.</i><br></blockquote><div><br class="webkit-block-placeholder"></div><div><br></div><div>Tony pointed out:</div><div><br></div><div><div></div></div><blockquote type="cite"><div><div><i>These aren't MITM safe. They're TOFU. They have no way to authenticate the server.</i></div><div><i><br></i></div><div><i>When you enroll a PAKE account, if you're talking to a MITM server, you're toast. The MITM can then enroll with the real service on your behalf and transparently proxy everything through, except the MITM will have the real credentials, and your credentials will only work with the MITM.</i></div></div></blockquote><div><br class="webkit-block-placeholder"></div><div>Your reply to him didn't address the argument he was making, possibly indicating that you probably misunderstood what he was saying about TOFU (trust-on-first-use).</div><div><br></div><div>Cheers,</div><div>Greg</div><div><br></div><div apple-content-edited="true"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <br><div><div><br></div><blockquote type="cite">Tony Arcieri wrote, On 01/24/2015 03:28 AM:<br><blockquote type="cite">On Fri, Jan 23, 2015 at 6:22 PM, U.Mutlu <<a href="mailto:for-gmane@mutluit.com">for-gmane@mutluit.com</a>> wrote:<br><br><blockquote type="cite">So, this is a safe & secure method.<br></blockquote><br>No, you're wrong, it's not, but please move this discussion to a more<br>appropriate mailing list and I'll continue the discussion.<br></blockquote><br>Why am I wrong? Where is your argument?<br>This is basic maths everyone can verify him-/herself.<br><br>And, I'm on-topic for this list, as it is about messaging.<br>If you don't like the discussion under this topic, then it is you who should move along to other topics or lists...<br><br>cu<br>Uenal<br><br><br>_______________________________________________<br>Messaging mailing list<br><a href="mailto:Messaging@moderncrypto.org">Messaging@moderncrypto.org</a><br>https://moderncrypto.org/mailman/listinfo/messaging<br></blockquote></div><br></div></body></html>