Re: [Debconf-discuss] Re: Please revoke your signatures from Martin Kraff's keys
On 26 May 2006, Matt Zagrabelny spake thusly:
> On Thu, 2006-05-25 at 16:16 -0500, Manoj Srivastava wrote:
>> Cracking is not a scientific study.
>
> cracking may not be, but determining the average number of people
> who spot an unofficial id could be construed to be.
I can honestly state that that number is like 100%, based on
some ID's I have seen created by people associated with my day job. I
am not sure what an uncontrolled social engineering effort
>>
>>>> Given that he is acknowledges trying to dupe people, why do
>>>> you think he is not lying about the contents of the ID?
>>>
>>> He didn't try to dupe people and this claim is getting rather old.
>>
>> He did dupe people --- into signing based on an unofficial document
>> which can be purchased at will. And it is obvious that large KSP's
>> have tired people, doing a repititive task, and have a lot of
>> people unfamiliar with key signing. The conclusion was foregon --
>> rartely do people have scientific studies belabouring the obvious.
>
> again, the question (i believe) has to be: what is obvious? it
> seems, manoj, you are basing a large part of your argument on the
> fact that ksp are inheritly insecure. but people are constantly
> testing the obvious things. can they be "proved" to be insecure?
> martin is supposed to accept (or know) the fact that ksp are
> insecure. (though they cant be *proved* to be)
*Sigh*, I guess I have to spell it out.
Here it goes. There is a large international gathering, with
only some people who knew other participants in the KSP. There were
several nationalities represented, and the travel documents
represented very different standards. Some were written in ink, some
were ostensibly extended on a different page from the initial
expiration date. In some, the language used for added notes was not
a language that people would understand.
This group of people also had some people who had never been
outside the country, and had no passports. There was no common
spoken language all participants were fluent in. English, while
coming close, was not there.
No one is familiar a priori with passports from all countries
represented. Insistence on a passport would have eliminatged people,
and passports were not made a requirement before the signing party.
There were 120 or so people present. The allocated time was
two hours, and the KSP was conducted standing up. This means you have
50 seconds to juggle two sets of ID's, ask about fingerprints, md5sum
of the file, and say hello.
You did this for two hours, standing up, juggling ID's, pen,
pieces of loose paper, and perhaps a bottle of water, since it was
hot and conducted outside.
You need *PROOF* that id checking was lax, man, your world
view is weird.
> this is an issue.
Precisemento.
> there are countless things that cannot be proved. rsa crypto cannot
> be "proved" to be a good crypto, it just appears to be. many things
> we rely upon have no proof of being "good", or "right", or what we
> expect them to provide, we just accept them as they are; and with
> that we accept the risk of not knowing (for 100%) that things are as
> we expect them to be.
And in this pool of expectations of good faith, any gaming of
the system needs to meet with strong disapproval. All I am saying.
manoj
--
..you could spend *all day* customizing the title bar. Believe me. I
speak from experience. -- Matt Welsh
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/%7Esrivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
Reply to: