[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2011 17:52:24 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list
On Sun, Apr 03, 2011 at 08:52:13PM -0400, Michael Gilbert wrote:
> Solar Designer wrote:
>
> > Yes, we may do this. Technically, an archive may be implemented as yet
> > another subscriber with its public key, where the private key
> > counterpart is not stored on any server and has a passphrase on it.
> > Thus, a possible compromise of the list server won't reveal past
> > messages (archived before the compromise, but not yet made public).
> >
> > Pushing the archive public will then be a manual process, but that's OK
> > if it's only done once a month (omitting the last month's worth of
> > messages). In fact, a posting to oss-security will need to be made
> > whenever the public archive is updated.
>
> Wouldn't the easiest solution be to have a cron job check that the age
> of the message is greater than X days, decrypt it, and mail it to a
> different archive/public list?
This would require that the private key (to decrypt the archive) be
stored on a server. Then if the server is compromised, the intruder
will gain access not only to new list traffic, but also to archived but
not yet published postings. Since the compromise _might_ be detected as
soon as on the same day (it depends), this might make a lot of a
difference (like, one day vs. one month worth of list traffic leaked).
> I think automatic publishing is the only way this is going to work.
> No one is going to want to manually do the work.
I wouldn't mind running a script manually and entering a passphrase once
a month. Of course, the script would need to be prepared first, which I
am not going to work on yet. At this time, we're just discussing.
> Plus an automatically
> enforced maximum time frame will force issues to get fixed.
Hopefully, yes.
> Automation
> also means that nothing is being veiled. Computers don't discriminate,
> humans do.
Computers are managed by humans anyway.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
