Re: [perpass] Getting started...

Hi Ben,

On 08/17/2013 12:37 PM, Ben Laurie wrote:
> On 16 August 2013 12:42, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
>> what should we be doing?
> 
> 
> Certificate Transparency is an anti-monitoring tool, amongst other useful
> properties.

Yep. Its a fine tool but more I guess directed at countering
an active attacker who spoofs as a web site and then monitors
or snarfs passwords or whatever.

> The more generalised idea of a public, verifiable log of stuff is probably
> useful in other ways, too.
> 
> For example, DNSSEC Transparency (OK, hardly much different from CT).
> 
> Someone mentioned default encrypting emails: sparse Merkle trees are an
> efficient data structure for making a verifiable map of email addresses to
> public keys...

neat idea... maybe.

However, that and other foo-transparency ideas also require
clients to ask the log about stuff, in a way that the log
can.... log.

For CT, thats ok since the web site itself (or its
auditors) can contact the CT log, but I wonder if that'd
become a problem for other foo-transparency applications,
e.g. how could an MUA query a log of public keys without
exposing the meta-data that I'm sending you an encrypted
message?

> Yes, I have a hammer and I am looking for nails.

:-)

S.

> 
> 
> 
> _______________________________________________
> perpass mailing list
> perpass@ietf.org
> https://www.ietf.org/mailman/listinfo/perpass
> 