[Cryptography] What is a secure conversation? (Was: online forums...)

[ianG]

On 27/12/13 21:36 PM, Theodore Ts'o wrote:
> On Fri, Dec 27, 2013 at 10:03:30AM +0300, ianG wrote:
>>
>> Trinity might also start mitm'ing, by actively sending messages out
>> to people that don't go to others.  So we might want to know that
>> all messages got to everyone, and no selective conversations are
>> happening.
>
> Yes, but *so* *what*?  How could an attacker to achieve some goal that
> he or she might want to achieve?
>
> It's not enough to say things like "an attacker could do XXX".  If
> we're going to do a credible analysis, this is critical.  Why is this
> important, and how much are we willing to pay (in terms of
> inconvenience, extra hardware, etc.) to avoid this potential "attack"?
>
> I don't know about other people, but I don't consider this list
> critical infrastructure.  If I were to not get some number of the
> messages, it wouldn't necessarily impact my life or my work in any
> significant way.


Hey, dude!  It's a hypothetical.  Jerry asked the rhetorical question:


 > I actually addresses this issue a couple of weeks back as a
 > hypothetical.  So let's think about it:  Just what *would* a "more
 > secure" version of this discussion (ignoring the actual technology)
 > look like?  Keep in mind that, by design, anyone can join by sending
 > a simple request to the moderator.  They'll promptly receive copies
 > of all messages.  Given this, what's your threat model?


WYTM?  Then the next step is we list out *all the threats we can think 
of* ... without prejudice.

Later on we do some risk analysis and decide which are serious or not.

Actually that's already begun; Trinity has promised to me in private 
email that she hasn't access to the mailing list software so she cannot 
possibly MITM us and change the messages as they wand their way across 
the ether.

So there's no risk there.

Hmmm... I have to think about this some more.  If you don't see this 
message, stick your hand up.



iang, more seasonal liquidity required, methinks...