<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Dear Tony,</div><div><br></div><div>On Sep 25, 2014, at 2:05 PM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Thu, Sep 25, 2014 at 1:52 AM, Ralf Senderek <span dir="ltr"><<a href="mailto:crypto@senderek.ie" target="_blank">crypto@senderek.ie</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;">Given the powers of a post-snowden MITM, the claim in Greg's posting seems<br>legitimate. </blockquote><div><br></div><div>This same class of attack will work on practically any system</div></div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>We've already acknowledged on twitter [1] the fact that this class of attack does not work on blockchains and DNSChain.</div><div><br></div><div>That is for two reasons:</div><div><br></div><div>1. With blockchains, only the owner of a domain can update SSL certificates. With CT and X.509, your domain does not belong to you exclusively, and therefore thousands of others can create SSL certs for your domain.</div><div>2. With blockchains, censorship or DoS to the P2P network can only prevent nodes from receiving updates, it does not make them forget what they've already learned. Since most SSL certs are long-lived, the threat is far less significant than it is with CT.</div><div><br></div><div>Kind regards,</div><div>Greg Slepak</div><div><br></div><div>[1] <a href="https://twitter.com/taoeffect/status/514884562720399360">https://twitter.com/taoeffect/status/514884562720399360</a></div></div></div></div></div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br></body></html>