4 ms·

> It's disingenuous to argue that Google and Mozilla implement PKP simply to protect their own properties. The post didn't name specific companies or products,

> It's disingenuous to argue that Google and Mozilla implement PKP simply to protect their own properties. The post didn't name specific companies or products, but on that note, is there a list of sites that Chrome and/or Firefox have pinned somewhere? I don't think TACK has been implemented in them. The thing with TACK is that it doesn't actually solve the key distribution problem. The draft itself states: TACK pins are easily shared between clients. For example, a TACK client may scan the internet to discover TACK pins, then publish these pins through some 3rd-party trust infrastructure for other clients to rely upon. Keywords: "some 3rd-party trust infrastructure" That is what DNSChain and the blockchain provides. It provides more than that though, and thus providing everything that TACK proposes too.

tptacek 13y ago
This is a misrepresentation of TACK. TACK will ordinarily be deployed similarly to HSTS: it's a key continuity scheme, like SSH. It doesn't require a "third party trust infrastructure". But unlike the CA system, TACK also supports the notion of a third-party root; the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site. Contrast to DNSChain, which requires that ordinary users trust a third-party server. DNSChain isn't going to happen.
- itistoday2 13y ago
  the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site. So how do you know that your subscription to EFF is secure? Contrast to DNSChain, which requires that ordinary users trust a third-party server. First-party, not third-party. What you described with EFF is a third-party, whereas DNSChain is a first (or 2nd) party, because either you own the server (1st party), or your friend does (2nd? party). DNSChain isn't going to happen. It's already happened. I'm using it right now. Where's TACK?
  - tptacek 13y ago
    You're playing semantic games with "first party" and "second party" and "third party". If I didn't think EFF was trustworthy, I wouldn't subscribe. Key continuity would still make TACK valuable; even without trusted third parties, widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected.
    - itistoday2 13y ago
      You're playing semantic games I am not. Those words have real meaning that doesn't disappear when you accuse me of playing semantic games. If I didn't think EFF was trustworthy, I wouldn't subscribe. I asked how do you _know_? With DNSChain, you actually have a great deal of certainty that is based on math, not public reputation. widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected. With DNSChain there are no compromised CAs to eradicate, and therefore no problem. You also get to keep your money, no more need to pay for SSL certificates.
      - tptacek 13y ago
        Ok, you have fun with that.

tptacek 13y ago

This is a misrepresentation of TACK. TACK will ordinarily be deployed similarly to HSTS: it's a key continuity scheme, like SSH. It doesn't require a "third party trust infrastructure". But unlike the CA system, TACK also supports the notion of a third-party root; the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site. Contrast to DNSChain, which requires that ordinary users trust a third-party server. DNSChain isn't going to happen.

itistoday2 13y ago
the EFF could run a site that would provide trustworthy pinned keys for arbitrary sites on the Internet, and you could subscribe to that site. So how do you know that your subscription to EFF is secure? Contrast to DNSChain, which requires that ordinary users trust a third-party server. First-party, not third-party. What you described with EFF is a third-party, whereas DNSChain is a first (or 2nd) party, because either you own the server (1st party), or your friend does (2nd? party). DNSChain isn't going to happen. It's already happened. I'm using it right now. Where's TACK?
- tptacek 13y ago
  You're playing semantic games with "first party" and "second party" and "third party". If I didn't think EFF was trustworthy, I wouldn't subscribe. Key continuity would still make TACK valuable; even without trusted third parties, widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected.
  - itistoday2 13y ago
    You're playing semantic games I am not. Those words have real meaning that doesn't disappear when you accuse me of playing semantic games. If I didn't think EFF was trustworthy, I wouldn't subscribe. I asked how do you _know_? With DNSChain, you actually have a great deal of certainty that is based on math, not public reputation. widespread deployment of TACK would practically eradicate dragnet surveillance through compromised CAs, because every attempt to forge a certificate would quickly be detected. With DNSChain there are no compromised CAs to eradicate, and therefore no problem. You also get to keep your money, no more need to pay for SSL certificates.
    - tptacek 13y ago
      Ok, you have fun with that.