Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 3 Apr 2011 20:38:44 -0400
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list

Josh Bressers wrote:

> > 
> > Benji's trolling does raise a couple real issues. The private keys and
> > passphrases of those responding here have now become highly lucrative
> > targets for attackers. Hence, everyone on this new list needs to use good
> > practices to keep their keys, hard drives, and computers safe.  There
> > should probably be some common guidelines for key safety for all
> > participants.
> > 
> 
> I don't buy this. It's really no secret who is involved in open source
> security, or most any security in general. If you're in this business and
> don't worry about such threats all the time, you're probably in the wrong
> field.
> 
> I think keeping this wide open will make us better at what we do. This is a
> bit silly I agree, but it's also brutally honest.

I'm actually not arguing in opposition to participant transparency.  In
fact I am 100% supportive of that.  Instead, I'm simply stating
that there is an increased threat to those participating (due to the
value attackers will find in being able to decrypt your private
traffic).

I was hoping to spur a discussion on some common practices to mitigate
this bigger threat (perhaps starting with a requirement to use pgp/gpg
smart cards so that an account compromise only leads to a passphrase
compromise rather than a key+passphrase compromise).

Best wishes,
Mike

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.