@eastdakota @csoghoian @randomoracle @grittygrease You can be legally compelled to decrypt session keys and not tell your clients about it
-
-
Replying to @bleidl
@bleidl@eastdakota@csoghoian@grittygrease Exactly; and even w/PFS feds can do real-time MITM by using CloudFlare as a decryption oracle1 reply 0 retweets 0 likes -
Replying to @randomoracle
@randomoracle@bleidl@eastdakota@csoghoian CloudFlare does not do this: https://www.cloudflare.com/transparency2 replies 0 retweets 0 likes -
Replying to @grittygrease
@grittygrease@randomoracle@bleidl@eastdakota@csoghoian then haven't you moved from "can't" to "won't"?1 reply 0 retweets 1 like -
Replying to @konklone
@konklone@randomoracle@bleidl@eastdakota@csoghoian We can't give up private keys, we won't give anybody access to our production servers1 reply 0 retweets 1 like -
Replying to @grittygrease
@grittygrease@randomoracle@eastdakota@csoghoian What if they ask for the client cert needed to authenticate to a certain keyserver?1 reply 0 retweets 0 likes -
Replying to @bleidl
@bleidl@randomoracle@eastdakota@csoghoian These count as our SSL keys in this statement: https://twitter.com/csoghoian/status/512664086786490369/photo/1pic.twitter.com/i721Jas5IT1 reply 1 retweet 0 likes -
Replying to @grittygrease
@grittygrease@bleidl@eastdakota@csoghoian No need to cough up SSL keys; providing on-demand decryption/signing for govt is enough1 reply 0 retweets 1 like -
Replying to @randomoracle
@randomoracle@bleidl@eastdakota@csoghoian read points 2 and 41 reply 0 retweets 0 likes -
Replying to @grittygrease
@grittygrease@bleidl@eastdakota@csoghoian Neither precludes CloudFlare hosting a webpage for LE to submit individual decryption requests1 reply 0 retweets 0 likes
@randomoracle @grittygrease @bleidl @eastdakota @csoghoian It can be a good thing even if it doesn't solve every problem.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.