On Thu, 2015-02-12 at 10:57 -0800, Steve Langasek wrote: > I'm surprised no one else has brought up this point yet: part of the reason > for using cryptographic PKI (web of trust; SSL CAs; etc) is to eliminate > man-in-the-middle attacks. Ah, but you see that is one of the beauties of proof of work. It is almost immune to MITM attacks. That is why bitcoin can trust the miners, even though has no PKI it can use to recognise them. The people who exchange bitcoin then use trust relationship bitcoin has built up with the miners (represented as the block chain) as a form of PKI they then use to authenticate each other. All that aside, the underlying corollary of the points I made earlier is personal meetings are a poor way of preventing MITM attacks. We already have a small proof of work system: the key that gets admitted to the keyring must be the one that went through the DAM. (It's not a lot, but in reality it's probably the _only_ thing that actually does anything for Debian's security.) You are saying a personal meeting enhances security, so lets perform a thought experiment. Lets remove the existing parts of system that are proof of work, and instead rely exclusively on the WoT. To do that we will no longer insist people sign their application email. Instead once they are accepted the Debian keyring maintainers pull the key associated with the email address off the key servers, and verify it is signed by two DD's - ie just use the WoT to authenticate the GPG key. Now lets say I know prospective DD who hasn't got around to creating a GPG key for his debian email address (which isn't uncommon). Since this is a MITM attack, I MITM his email address. Not easy, but since we are defending against a MITM attack I am allowed to assume it occurred. I go to a foreign country that doesn't share my language so there is a language barrier, present my forged documents and bingo, I have control control over what packages are uploaded to the archive. The truly ironic part of this is it is the first MITM attack I've come across that required a real, actual human, in the middle.
Attachment:
signature.asc
Description: This is a digitally signed message part