Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of zikula.org
	designates 74.125.82.177 as permitted sender)
	client-ip=74.125.82.177; envelope-from=drak@zikula.org;
	helo=mail-we0-f177.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAAS2fgR0khyJxmz9c2Oc87hOFgiNuiPJuaeugGajdo_EcKEW9w@mail.gmail.com>
References: <52A3C8A5.7010606@gmail.com>
	<1795f3067ba3fcdd0caf978cc59ff024.squirrel@fruiteater.riseup.net>
	<52A435EA.7090405@gmail.com> <201312081237.24473.luke@dashjr.org>
	<CANAnSg2OrmQAcZ+cZdtQeADicH3U29QOgYPfP1AQhOMP6+P1wg@mail.gmail.com>
	<CAAS2fgR0khyJxmz9c2Oc87hOFgiNuiPJuaeugGajdo_EcKEW9w@mail.gmail.com>
From: Drak <drak@zikula.org>
Date: Sun, 8 Dec 2013 20:40:04 +0000
Message-ID: <CANAnSg2tep2VURmudfNModuJAryw8hfOj8Z8idVbt37keiZ8Lg@mail.gmail.com>
To: Gregory Maxwell <gmaxwell@gmail.com>
Content-Type: multipart/alternative; boundary=089e01493e4482abb804ed0be382
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org,
	your thoughts?
Precedence: list

--089e01493e4482abb804ed0be382
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 8 December 2013 19:25, Gregory Maxwell <gmaxwell@gmail.com> wrote:

> On Sun, Dec 8, 2013 at 11:16 AM, Drak <drak@zikula.org> wrote:
> > BGP redirection is a reality and can be exploited without much
>
> You're managing to argue against SSL. Because it actually provides
> basically protection against an attacker who can actively intercept
> traffic to the server. Against that threat model SSL is clearly=E2=80=94 =
based
> on your comments=E2=80=94 providing a false sense of security.


Let me clarify. SSL renders BGP redirection useless because the browser
holds the signatures of CA's it trusts: an attacker cannot spoof a
certificate because it needs to be signed by a trusted CA: that's the point
of SSL, it encrypts and proves identity, the latter part is what thwarts
MITM. If there was an MITM the browser screams pretty loudly about it with
a big threat warning interstitial.

Regards,

Drak

--089e01493e4482abb804ed0be382
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On 8=
 December 2013 19:25, Gregory Maxwell <span dir=3D"ltr">&lt;<a href=3D"mail=
to:gmaxwell@gmail.com" target=3D"_blank">gmaxwell@gmail.com</a>&gt;</span> =
wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div class=3D"im">On Sun, Dec 8, 2013 at 11:=
16 AM, Drak &lt;<a href=3D"mailto:drak@zikula.org">drak@zikula.org</a>&gt; =
wrote:<br>


&gt; BGP redirection is a reality and can be exploited without much<br>
<br>
</div>You&#39;re managing to argue against SSL. Because it actually provide=
s<br>
basically protection against an attacker who can actively intercept<br>
traffic to the server. Against that threat model SSL is clearly=E2=80=94 ba=
sed<br>
on your comments=E2=80=94 providing a false sense of security.</blockquote>=
<div><br></div><div>Let me clarify. SSL renders BGP redirection useless bec=
ause the browser holds the signatures of CA&#39;s it trusts: an attacker ca=
nnot spoof a certificate because it needs to be signed by a trusted CA: tha=
t&#39;s the point of SSL, it encrypts and proves identity, the latter part =
is what thwarts MITM. If there was an MITM the browser screams pretty loudl=
y about it with a big threat warning interstitial.</div>

<div><br></div><div>Regards,</div><div><br></div><div>Drak</div></div></div=
></div>

--089e01493e4482abb804ed0be382--