4 ms·

I haven't paid anyone yet because no attack has yet met the conditions. As others have noted, a valid SSL certificate is required for this to work. Moxie sugge

I haven't paid anyone yet because no attack has yet met the conditions. As others have noted, a valid SSL certificate is required for this to work. Moxie suggested that I acquire a certificate for a similar domain to meet that requirement but that doesn't meet either the normal definition of valid (If a show requires a valid ticket to be shown at the entrance, will one from last night do?). He did claim that producing a forged certificate is possible and I have no reason to doubt him. However, he noted that he nor anyone else would produce one for a reward of this amount. We were still corresponding when he made the tweet in question. I ultimately asked him if he believed that a certificate to another domain was a valid certificate and his reply didn't address that point but discussed instead why he and tptacek are frustrated by these kind of contests. I'm sorry I seem to have offended you.

tptacek 13y ago
You haven't offended me. You did however launch a "contest" to demonstrate the soundness of using browser Javascript cryptography to protect user secrets, and made exactly the kind of slip-up that trivially demonstrates what a bad idea browser JS crypto is: to wit, your application couldn't even protect its own pages, let alone use them to safely deliver crypto code; you provided an ambiguous address and didn't properly lock the server down to SSL, so you couldn't even rely on users getting to your app under SSL. Your app wouldn't have demonstrated any of the security value (largely nonexistent) of browser JS crypto even if it had been careful about SSL hygiene. But you spared Moxie the trouble of making that case. Somehow I doubt Moxie cares too much about the $1000, but: you screwed up, lost the contest, and then (from what I can see) weaseled. The real point isn't "pay Moxie $1000"; it's, "don't try to run contests like this".
- lawnchair_larry 13y ago
  You can say it's a dumb contest, just like I will, but you can't say he weaseled. Unless you would like to first admit to a reading disability. It says, plainly, he wouldn't click unless there was a valid SSL cert. Do you know what sslstrip does? I know you do, so stop playing dumb. "I won't promise to log in if you can't provide a valid SSL certificate :)" Apologize to absherwin and admit you were wrong, or it is you who is the weasel.
  - tptacek 13y ago
    I can live with your belief that I'm a weasel. I think Adam Sherwin owes Moxie $1000. I stand by my opinion.
    - lawnchair_larry 13y ago
      That aside, is there a reason you're naming and shaming? It seems a little malicious. You know that your announcement is going to come up under search results for his real name. If that wasn't intentional and you hadn't considered it, it would be classy to delete that. Granted "absherwin" is not totally anonymous, your derogatory proclamation attached to the proper form of his name is a bit much. He's misguided, not malicious.
      - tptacek 13y ago
        Naming and shaming who? Unlike you, Sherwin has never been anonymous. Like me, when he criticizes people online, he signs his name.
        lawnchair_larry 13y ago
        > Naming and shaming who? Again, stop playing dumb. Type his Firstname Lastname into the search bar at the bottom - your "name and shame" post is the only result. > Unlike you, Sherwin has never been anonymous. News flash: Moxie Marlinspike isn't Moxie's real name either.
        tptacek 13y ago
        Moxie Marlinspike is not hiding behind an alias, and neither is Sherwin. I didn't sleuth his name from anywhere; it was public at least since last night, on Twitter. Presumably, the guy who starts a contest under an HN nick with his name in it and then emails numerous people from an address with his name in it is not trying to hide his identity. Nobody is playing dumb with you. I'm not afraid to be wrong in a debate with you; I just haven't had the opportunity to be, yet.

tptacek 13y ago

You haven't offended me. You did however launch a "contest" to demonstrate the soundness of using browser Javascript cryptography to protect user secrets, and made exactly the kind of slip-up that trivially demonstrates what a bad idea browser JS crypto is: to wit, your application couldn't even protect its own pages, let alone use them to safely deliver crypto code; you provided an ambiguous address and didn't properly lock the server down to SSL, so you couldn't even rely on users getting to your app under SSL. Your app wouldn't have demonstrated any of the security value (largely nonexistent) of browser JS crypto even if it had been careful about SSL hygiene. But you spared Moxie the trouble of making that case. Somehow I doubt Moxie cares too much about the $1000, but: you screwed up, lost the contest, and then (from what I can see) weaseled. The real point isn't "pay Moxie $1000"; it's, "don't try to run contests like this".

lawnchair_larry 13y ago
You can say it's a dumb contest, just like I will, but you can't say he weaseled. Unless you would like to first admit to a reading disability. It says, plainly, he wouldn't click unless there was a valid SSL cert. Do you know what sslstrip does? I know you do, so stop playing dumb. "I won't promise to log in if you can't provide a valid SSL certificate :)" Apologize to absherwin and admit you were wrong, or it is you who is the weasel.
- tptacek 13y ago
  I can live with your belief that I'm a weasel. I think Adam Sherwin owes Moxie $1000. I stand by my opinion.
  - lawnchair_larry 13y ago
    That aside, is there a reason you're naming and shaming? It seems a little malicious. You know that your announcement is going to come up under search results for his real name. If that wasn't intentional and you hadn't considered it, it would be classy to delete that. Granted "absherwin" is not totally anonymous, your derogatory proclamation attached to the proper form of his name is a bit much. He's misguided, not malicious.
    - tptacek 13y ago
      Naming and shaming who? Unlike you, Sherwin has never been anonymous. Like me, when he criticizes people online, he signs his name.
      - lawnchair_larry 13y ago
        > Naming and shaming who? Again, stop playing dumb. Type his Firstname Lastname into the search bar at the bottom - your "name and shame" post is the only result. > Unlike you, Sherwin has never been anonymous. News flash: Moxie Marlinspike isn't Moxie's real name either.
        tptacek 13y ago
        Moxie Marlinspike is not hiding behind an alias, and neither is Sherwin. I didn't sleuth his name from anywhere; it was public at least since last night, on Twitter. Presumably, the guy who starts a contest under an HN nick with his name in it and then emails numerous people from an address with his name in it is not trying to hide his identity. Nobody is playing dumb with you. I'm not afraid to be wrong in a debate with you; I just haven't had the opportunity to be, yet.