<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On Sep 27, 2014, at 3:31 PM, Paul Wouters <<a href="mailto:paul@cypherpunks.ca">paul@cypherpunks.ca</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Sat, 27 Sep 2014, Greg wrote:<br><br><blockquote type="cite">The two certs (legit and false) will happily live side-by-side in the tree undetected by the gossip protocol.<br></blockquote><br>That's why clients reporting a cert change to the TLS server is a very<br>useful tool. Once you are no longer MITM'ed and see a different cert,<br>you inform the legitimate owner that something bad happened. So it<br>becomes obvious to everyone without needing to monitor "1000s of logs",<br>because the owners will automatically collect rogue certs for<br>investigation.<br></blockquote><div><br></div>OK, interesting, that I haven't seen before in any CT documentation.<div><br></div><div>If that's how it worked then the MITM would need to consistently filter all traffic to hide those reports back to the server (they'd end up needing to perpetually MITM in other words). That would be difficult to do.</div><div><br></div><div>Is there any documentation on the details of this? This could be done for today's TLS actually and would be useful.</div><div><br></div><div>I suspect this might go up against Laurie's "Must be fast" criteria though, as it would add more overhead to each TLS connection.</div><div><br></div><div><blockquote type="cite">For important domains (defined by the user, for example by "having been<br>there once before") it can simply insist on rejecting every cert change<br>that has not been validated by a handful of indepedant logs. </blockquote><br></div><div>What do you mean by "validated by a handful of independent logs", could you elaborate on that? What part of CT is that in reference to?</div><div><br></div><div>Kind regards,</div><div>Greg</div><div><div apple-content-edited="true">
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span></div></div><div apple-content-edited="true"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"><br></span></div></body></html>