4 ms·

I think the hesitations about passphrase being subject to brute force, rainbow table, etc. are warranted, but I have another concern: If my passphrase gets com

I think the hesitations about passphrase being subject to brute force, rainbow table, etc. are warranted, but I have another concern: If my passphrase gets compromised, I have to retire the keypair. That's true of a key file with current asymmetric systems; but, presently if the passphrase of my GPG private key is compromised (e.g. by a hardware key logger), I only have to change the passphrase and ensure the old keyfiles are destroyed. With MiniLock, if my passphrase is compromised the entire key material is compromised and I need to revoke the public key. But how do I revoke it? Do I tweet a message with the private key saying the public key is revoked? Will there be a centralized place to publish revocation messages? Efficient key revocation will be absolutely critical to this system and that's hard if the key distribution mechanism is tweets or some other ad hoc mechanism. This is one thing that PGP key servers really help with.

selimthegrim 12y ago
I actually approached Kobeissi with this point in the meeting in Noisy Square right after the talk, suggesting he integrate a TPM into his key management system (like how you can call out to one in Firefox for SSL with libpkcs5.so or some similarly named library). He responded that the specs were open enough that anyone could add that in. As to a centralized place your guess is as good as mine. Also can MacBook users even access their TPMs?
- BuildTheRobots 12y ago
  Depending on who you're protecting against you might want to _really_ avoid trusting your TPM.
  - higherpurpose 12y ago
    Yeah, I wouldn't trust the TPM - certainly not from a Windows machine, and not even an Apple one after the recent revelations/research, which shows Apple tries to make the device secure against "regular" hackers, but very easy to access by Apple itself or the US government.
    - selimthegrim 12y ago
      My current one is from atmel in 2008, before atmel quit making them, so I figure at least in this case I'm safe. I would probably not use a newer one if I was worried about TLAs though. As I am currently in the market for an MBP, where do I find this information about Apple TPMs?
      - selimthegrim 12y ago
        My bad, Apple pulled them in 2006.

selimthegrim 12y ago

I actually approached Kobeissi with this point in the meeting in Noisy Square right after the talk, suggesting he integrate a TPM into his key management system (like how you can call out to one in Firefox for SSL with libpkcs5.so or some similarly named library). He responded that the specs were open enough that anyone could add that in. As to a centralized place your guess is as good as mine. Also can MacBook users even access their TPMs?

BuildTheRobots 12y ago
Depending on who you're protecting against you might want to _really_ avoid trusting your TPM.
- higherpurpose 12y ago
  Yeah, I wouldn't trust the TPM - certainly not from a Windows machine, and not even an Apple one after the recent revelations/research, which shows Apple tries to make the device secure against "regular" hackers, but very easy to access by Apple itself or the US government.
  - selimthegrim 12y ago
    My current one is from atmel in 2008, before atmel quit making them, so I figure at least in this case I'm safe. I would probably not use a newer one if I was worried about TLAs though. As I am currently in the market for an MBP, where do I find this information about Apple TPMs?
    - selimthegrim 12y ago
      My bad, Apple pulled them in 2006.