Re: [Debconf-discuss] Please revoke your signatures from Martin Kraff's keys
On 25 May 2006, Gunnar Wolf said:
> Manoj Srivastava dijo [Thu, May 25, 2006 at 02:36:37AM -0500]:
>> Hi,
>>
>> It has come to my attention that Martin Kraff used an unofficial,
>> and easily forge-able, identity device at a large key signing party
>> recently. This was apparently to belabour the obvious point that
>> large KSP's are events where it is hard to reasonably check. in a
>> large international KSP, anything beyond matching
>> pictures/names/expiry dates, especially after an hour or so after
>> starting.
>>
>> Presenting essentially a fake ID is an act of bad faith that leads
>> one to wonder how many of the other key signing parties he has
>> attended did he present a false ID? (...)
>
> The person standing next to me, Rodrigo Gallardo, spotted Martin's
> fake ID. I went to him just after the KSP finished, and yes, he
> waved me his real country ID papers.
But a number of people were taken in by this social
engineering crack and failed to ask for the real ID.
> Anyway, I do think his ID is still more credible than many national
> IDs. Some people complained that Graham Wilson had only a Texas
> driver license - Well, I showed him _three_ different official IDs -
> The elector card (Mexico's main official document), my driver
> license and my University worker card. None of them has an expiry
> date (the University one has an issue date and is refrended yearly,
> but does not formally expire).
All this means is that his crack was well put together with
credible looking fake ID's that would fool most people checking the
ID's of all the other KSP participants. A clever social engineering
crack, based on the volume of unfamiliar documents people had to
check, and how tired they were.
> I have to add one more thing: His fake ID looked way more serious
> than _any_ of the IDs I've ever had. Including my passport (which I
> didn't bring to Debconf).
All this means is that his crack was well put together with
credible looking fake ID's that would fool most people checking the
ID's of all the other KSP participants. A clever social engineering
crack, based on the volume of unfamiliar documents people had to
check, and how tired they were.
> So this does not fundamentally show bad will on his part, but a real
> weakness in our protocol.
Yup, standard cracker disclaimer. I break into your computer
and look at data not because of ill will, but just to demonstrate you
need better security.
>
> Maybe we should just drop holding KSPs, and fall back to the
> traditional method of "Hey, nice dinner we had yesterday. Say, now
> that you know me, my family and my history, would you like to sign
> my key as well?" - Signing for people you actually know, not just
> linking faces to government IDs.
I think so too. Crackers have made us retreat from many
practices that were common place before the morris work, and I think
KSP's have now fallen to crackers as well.
manoj
--
"There are things that are so serious that you can only joke about
them" Heisenberg
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/%7Esrivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
Reply to: