Re: [Trans] Threat model outline, attack model

Tao Effect <contact@taoeffect.com> Wed, 01 October 2014 16:15 UTC

Content-Type: multipart/signed; boundary="Apple-Mail=_DE45AF54-5181-493A-AB0C-A9DD64E5157F"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Tao Effect <contact@taoeffect.com>
In-Reply-To: <CAA7UWsW06qYWfO_CDGEvhR2OJbiodrJ96qPuz=6-DnK4XNdR7g@mail.gmail.com>
Date: Wed, 01 Oct 2014 09:15:57 -0700
Message-Id: <530D1136-916E-41F7-A9EC-819C5564CA33@taoeffect.com>
References: <5411E511.1040605@bbn.com> <CABrd9STmog8-JZCg9Tfv_ToUswY=9LBcZAPQM2cqUVcO0dhAnQ@mail.gmail.com> <54173589.3000404@bbn.com> <CABrd9SRShqm1r-2ajbqD5w1s686ciyjcEvywsXZaapgmi57NsA@mail.gmail.com> <54242F8A.2080602@bbn.com> <CABrd9SSwAdv-mAgofNT6bMWky7q=bZhAaX=L4gZUQDkROQ-3ZA@mail.gmail.com> <54258AF0.7090602@bbn.com> <CABrd9SQNXHdJQCC3JQJirqdkg_ub0oXCkxPqit9H6LjUPqNioA@mail.gmail.com> <54297249.1090409@bbn.com> <CABrd9ST59Yd3GDjxMiX9jMg68_BRd2_v0Mpo8u_oW1zM1VWjjA@mail.gmail.com> <542C1063.50404@bbn.com> <CAA7UWsW06qYWfO_CDGEvhR2OJbiodrJ96qPuz=6-DnK4XNdR7g@mail.gmail.com>
To: David Leon Gil <coruus@gmail.com>
Archived-At: http://mailarchive.ietf.org/arch/msg/trans/ixTY7iC-amsHbgQ9wsYJ5CIY9tg
Cc: Ben Laurie <benl@google.com>, "trans@ietf.org" <trans@ietf.org>, Stephen Kent <kent@bbn.com>
Subject: Re: [Trans] Threat model outline, attack model
Precedence: list

On Oct 1, 2014, at 7:54 AM, David Leon Gil <coruus@gmail.com> wrote:

> On Wed, Oct 1, 2014 at 10:32 AM, Stephen Kent <kent@bbn.com> wrote:
>> If a "broader scope" means using more ambiguous terms, I can't see why that would be an improvement.
>> It has the flavor of "CT is obviously good, so let's just do it."
> 
> Okay. You've convinced me.
> 
> So: I've disabled syslog on all my servers. I can't define a-priori
> what security issues logging might detect. Thus there's no point in
> logging anything.

1. If CT were as useful and usable as syslog, I'd have fewer problems with it.

2. syslog does not claim to "make it impossible to [xyz hacker thing] without detection", whereas such claims have been made about CT [1].

3. Nor is syslog presenting it as an IETF security-related protocol.

4. syslog isn't "overtly forcing" [2] architectural changes upon anyone based on aforementioned false claims.

Kind regards,
Greg Slepak

[1] http://blog.okturtles.com/2014/09/the-trouble-with-certificate-transparency/
[2] https://twitter.com/Cryptoki/status/514866111968706560

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

Attachment: signature.asc

[Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Katriel Cohn-Gordon
[Trans] Fwd: Threat model outline, attack model Melinda Shore
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Dmitry Belyavsky
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Paul Wouters
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Matt Palmer
Re: [Trans] Threat model outline, attack model Greg
Re: [Trans] Threat model outline, attack model Gervase Markham
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model Ralph Holz
Re: [Trans] Threat model outline, attack model Ben Laurie
Re: [Trans] Threat model outline, attack model Stephen Kent
Re: [Trans] Threat model outline, attack model David Leon Gil
Re: [Trans] Threat model outline, attack model Tao Effect
Re: [Trans] Threat model outline, attack model Stephen Kent

Re: [Trans] Threat model outline, attack model

Attachment: signature.asc