468 reputation
26
bio website
location
age
visits member for 1 year, 7 months
seen Mar 26 at 20:35

Sep
14
awarded  Yearling
Jul
4
comment Control over IT security
Of course everything at the end depends on one's own evaluation/estimation of different matters in the society. Apology that I have thus to say that there could be no well meaningful argumentation in the current context in the sense of e.g. some topics in mathematics and I am afraid we would be eventually arguing like persons of different religions (or over tastes and colours).
Jul
4
comment Control over IT security
I fully agree that NIST has contributed very much to IT security, e.g. the AES standard for encryption. In my personal view, national standardization bodies could further contribute to IT security by issuing certificates to software and hardware products that are relevant to IT security. (I happened to know long ago that the German standardization body issues certificates certifying the standard conformity of programming language compilers. The same work evidently should be doable for IT security software and hardware IMHO.)
Jul
4
comment Control over IT security
@Xander and schroeder: Well, of course nobody can be infalliable. But generally in countries with comparatively good functioning governments the employees of governments are under good oversight to do their jobs properly. (In Germany, for example, government employees have also to swear an oath upon being employed.) Certainly one could question whether all such measures really help. But then a question in the other direction is: Why would one consider that the lack of such measures be better? For me personally anyway the said hypothetical scenario without FDA is quite clear.
Jul
4
comment Security of remailers
[Addendum] The tapping points could be more conveniently situated at the providers of the first nodes of remailer chains, if I don't err.
Jul
4
comment Security of remailers
Thanks. I am concerned about the location of the router of the first node that one sends the message to. Since such first nodes of remailer chains are certainly a very tiny fraction of all Internet nodes, it would be advantagesous IMHO for the agencies to concentrate their tapping activities there.
Jul
4
comment Security of remailers
The purpose is to know whether use of remailers is "perfectly" safe and, if not, what would be the best to do. See also my comment to the post of qbi.
Jul
4
comment Security of remailers
If I don't err, it would thus seem to be safer to send messages from Internetcafes/callshops to such Usenet groups as alt.anonymous.message and let the recipient collect them from there according to certain distinguishing traits.
Jul
4
comment Security of remailers
I suppose there is an misunderstanding. I mean: If I send a mail to anywhere from my PC, my IP-address is contained in the entire data package and that IP-address IMHO can't be faked. So if the transmission to the "first" node is tapped, the sender would be known. (I know that the normal sender address, which is in the form of a text string, could be altered, if one likes.)
Jul
4
asked Security of remailers
Jul
4
comment Control over IT security
Who checks the conformity to such standards? How trustworthy are the checkers, if these are not governmental?
Jul
4
comment Control over IT security
It's not a homework question. It's actually inspired by discussions in my thread "Risks of software backdoors" posted a day earlier. Please read also my comment to the post of tylerl above.
Jul
4
comment Control over IT security
The big problem IMHO is that, as there are no governmental authorities that excercise tight control over IT security, there couldn't be any "genuine" IT security in any practical sense. (Just imagine the case that there were no FDA in the US and everything would have to depend on the honesty and self-discipline of the commercial people involved.)
Jul
3
asked Control over IT security
Jul
3
comment Risks of software backdoors
Ok. If there is indeed no way at all to determine the potential presence or not of backdoors in a software, how could we nonetheless sensibly talk of the "security" of communication, in which that software plays an essential role? This is what I can't comprehend. (I don't like to blindly trust anyone.)
Jul
3
comment Risks of software backdoors
Analogous test centres and tests as well as the application procedures for issuing certificates certifying that the software is correct (in particular free of bugs -- programming errors or intended malicious ones).
Jul
3
asked Risks of software backdoors
Jun
27
comment Trust among the root-CAs
What I meant is: If I transfer money from my bank to be pay out by another bank to my partner, I need only trust my bank and need not care whether the other bank is good or not. There is apparently nothing analogous with the CAs.
Jun
24
comment Trust among the root-CAs
I trust the bank where I have an account. I don't need to worry about anything of any other banks at all, yet there is no problem of my money transfer to or from any point of the world. This would IMHO mean that there is in fact a "nearly" global bank. If not a single global root-CA, couldn't a few big root-CAs be a practically realizable goal? Suppose there are only 5 root-CAs. Then one could have the option of only using a CA under one of the 5 root- CAs or simultaneously using a CA under each of the 5 root-CAs, though at a higher cost. Could you please comment on that "speculation" of mine?
Jun
23
comment Trust among the root-CAs
But according to bobince: "If you go to site-A.com and your browser doesn't trust any root or intermediary CA on its certificate chain, you are out of luck." I understand this to mean that I can't "arbitrarily" choose a CA that I personally (especially) prefer.