See also:

Jaminy Prabaharan failed Google Summer of Code and Chris Lamb made her an administrator why?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Tor exit nodes

On Monday, 9 October 2017 10:56:58 PM AEDT Adam Borowski wrote:
> On Mon, Oct 09, 2017 at 12:47:47PM -0700, Russ Allbery wrote:
> > Adam Borowski <[email protected]> writes:
> > > I for one concluded there's enough ways for a government to screw me,
> > > thus I bought a Yubikey 4 (most convenient, durable and fast).  But if I
> > > suddenly receive the Bogatov treatment, my secret key will be not
> > > trustworthy.
> > 
> > Please do not attempt to protect your Debian keys against such treatment!
> > If you're arrested or coerced by authorities, please look after your own
> > safety, even if that means giving them what they want.  The project will
> > find other ways to cope.
> 
> I don't recall ever receiving a gpg-encrypted mail that warranted strong
> forward secrecy.  Thus, the only harm to the project would be using my
> signature.  And there's enough ways for bad guys to obtain _a_ DD's
> signature that there's no point in caring that much.

Yes.  Remember that supposed "exploit" against a bug in sshd that required 
running as root but which actually emailed /etc/shadow /etc/passwd and other 
interesting files to Germany?

> > We have to assume that threat model will compromise keys anyway, since few
> > people would be able to resist that sort of pressure.  And I would hate to
> > see someone seriously injured trying to protect project keys.  You are not
> > a personal single point of failure -- there are still multiple
> > opportunities to later detect such an attacker and mitigate the threat.
> 
> We have ~1000[1] DDs from various backgrounds and allegiances.  For most
> governments you'll find a DD ready to sign something nasty because of
> "patriotism" or other personal convinction, with full free will, without
> even an incentive, much less being forced.

That sounds plausible.  I am not one of those DDs, but I know that some of you 
won't believe it.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/