public inbox for nncp-devel@lists.cypherpunks.ru
Atom feed
From: Jonathan Lane <tidux@sdf•org>
To: nncp-devel@lists.cypherpunks.ru
Subject: Re: Website TLS certificates
Date: Wed, 4 Aug 2021 18:54:26 +0000 [thread overview]
Message-ID: <20210804185426.nfu5me4ab7ssfq7r@faeroes.freeshell.org> (raw)
In-Reply-To: <YQqNTnaQ54Op2O+o@stargrave.org>
On Wed, Aug 04, 2021 at 03:51:13PM +0300, Sergey Matveev wrote:
> I just read about it, but actually because of *forced* TLS usage I do
> not like that project. It just forces me to do something very
> inefficient and lame when I use IPsec, isolated LAN, localhost. Why do
> not they use Noise, that is much much more simpler even than TLS 1.3
> (very simplified version, comparing to TLS 1.2)? I understand that it is
> because of TLS-libraries availability, but the same reason can be
> applied to HTTP/WWW -- they are already existing too. Basically Gemini
> even answers that in the FAQ: when you see "gemini://" you expect to see
> no advertisements and similar junk. But who forbids including them in
> Gemini pages, in Gopher pages? The fact that people who run Gemini are
> not interested in that?
No, the fact that Gemini and Gopher are single-request-per-page
protocols. Dynamic hotloaded web style ads are fundamentally impossible.
The worst you could get on Gemini is first-party sponsored content.
> >[...]
> >But what governments do is not the same as what people do. I have been a
> >supporter of EFF for a very long time (decades). They are the good guys
> >here.
>
> Completely agreed with everything said above. I also supported (with
> money) EFF and very respect many people behind that organization. But...
> EFF changed drastically over time. Possibly I changed much especially
> for the last decade :-). But then EFAIL issue appeared (https://efail.de/)
> EFF massively spread information that the whole OpenPGP ecosystem is so
> bad, that it should not be used at all, better to use Signal.
> https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now
> (this is slightly updated article, mentions patches and fixes)
> OpenPGP is far from being ideal, perfect, having good (simple!) design,
> but it is still the only way to use strong serious cryptography on most
> systems (GnuPG was often installed out-of-box in most GNU/Linux
> distributions)! And EFF calls to abandon it. With the "Signal"
> suggestion as a replacement. "Signal" without any doubts is the best
> tool among WhatsApp/Telegram/Viber/do-not-know-what-people-also-use, but
> it still uses cellphone binding, that is *completely* unacceptable for
> me and it is the reason I can not frankly recommend it (I do not say "I
> do not recommend it", I just do not say about it at all). EFF
> cypherpunks values has changed? They think that every person has the
> cellphone? That it is acceptable to think that everybody definitely has
> it? I can not agree with that. Moreover, how can they tell about
> WhatsApp usage? https://ssd.eff.org/module-categories/tool-guides
> Seriously? No, this is not the same organization I supported before. We
> have very different values and acceptable criteria.
Everyone DOES have a smartphone in the US, statistically speaking. Many
people have a smartphone but not a PC. That's why the recommendations
changed. Even in places like Japan, China, India, and Brazil, so many
people have smartphones that businesses set up "storefronts" inside
popular app platforms: LINE, WeChat, and Whatsapp respectively. Asking
people to not use smartphones is unrealistic at this point, so the EFF
is making security recommendations with that in mind.
> Some sentences from it I became very agreed with:
>
> [...] and I am now a proponent of the idea that just because
> something can be built, it doesn’t mean it should be built.
>
> I have seen, and I am seeing every day, the dangers of completely
> unrestricted speech, and I don’t want to be the one enabling that.
>
> [...] your freedom of speech isn’t my obligation to enable you and
> give you a platform.
Protip: 99% of the English-speaking people saying/writing this are just
asshurt that the political right wing finally figured out how to use
FOSS, cryptography, etc. They're trying to return to a Soviet-style
world where only the political left has any kind of infosec capability.
> >I'm not saying that Let's Encrypt is perfect, but mere presence in the US
> >doesn't constitute technical control by the US government.
>
> Agreed. But the fact that for years all major big software companies
> like Apple/Google/Microsoft removed every gratis CA, and then *suddenly*
> there appeared Let's Encrypt (virtually from nowhere) that is heavily
> supported by all major vendors. Who would have the most benefit, profit
> and interest in single CA responsible for >70% of all websites?
> Intelligence agencies without any doubts. Of course currently there is
> no evidence that Let's Encrypt is compromised and is under direct
> control of any of those agencies, but I really honestly can not believe
> that that kind of huge CA is located under US jurisdiction and
> completely independent and not compromised (from cryptographic point of
> view). All US special forces history shows us that NSA/whatever can even
> repack boxes with Cisco hardware, implanting hardware backdoors, than to
> bury their wish of surveillance. No offence or disrespect to anybody I
> have mentioned! Surveillance, intelligence, espionage is *the* job of
> that kind of forces, it is what they are intended to do, they are
> essential for security, defence and stability in the country (at least).
> And they try to do their best. And Let's Encrypt, people behind it, its
> founders -- I hope are honest people trying to do their best too. But I
> just can never believe that any expected natural will of special forces,
> when there is question of national security, can be prevented/denied by
> "ordinary" company under their jurisdiction. Possibly that could happen
> in Netherlands, Sweden, but unbelievable it could be possible in
> countries like China, Russia, US.
I disgree with your modeling of the threat environment. If a government
agency is going to interfere with a TLS CA like Let's Encrypt, the
threat posed by that is that they can silently MITM a website like
NNCPGo.org. They can do that right now anyways due to plaintext HTTP.
Either the tarball signature matches, or it doesn't, and website HTTPS
doesn't change that. What it does change, as John mentioned, is
reputation. I passed up on using NNCP for over a year until I saw it
mentioned on his blog specifically because it looked like a classic
malware profile from an American perspective: unknown software from
Russia delivered without a certificate or with an untrusted one. If
your goal is to spread adoption, there needs to be some HTTPS mirror,
whether hosted by you or someone else.
> Agree with that points. But possibly I just want too much at once: want
> only either to jump or to stand without moving, throwing away the
> possibility to make at least some small step in the right direction.
Yeah, that's too much. Chat platforms are ruled by Metcalfe's Law. If
it's too hard for people to bring their non-technical friends along they
won't bother, because their conversations with those friends will still
be on the insecure platform. Signal is easy for those non-technical
people to use. Matrix with forced e2e OLM based crypto might be another
good option some day once the clients and servers mature a bit.
--
tidux@sdf•org
SDF Public Access UNIX System - http://sdf.org
next prev parent reply other threads:[~2021-08-04 18:54 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-19 16:57 [EN] NNCP 7.4.0 release announcement Sergey Matveev
2021-07-21 18:47 ` Jonathan Lane
2021-07-21 19:13 ` John Goerzen
2021-07-21 19:32 ` Website TLS certificates Sergey Matveev
2021-08-03 15:58 ` John Goerzen
2021-08-03 18:02 ` Sergey Matveev
2021-08-04 2:46 ` John Goerzen
2021-08-04 12:51 ` Sergey Matveev
2021-08-04 18:54 ` Jonathan Lane [this message]
2021-08-04 19:24 ` Sergey Matveev
2021-08-04 20:16 ` Sergey Matveev
2021-09-02 8:59 ` Sergey Matveev