Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.python > #93265
| Path | csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!1.eu.feeder.erje.net!bcyclone05.am1.xlned.com!bcyclone05.am1.xlned.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!post.news.xs4all.nl!not-for-mail |
|---|---|
| Return-Path | <jeanpierreda@gmail.com> |
| X-Original-To | python-list@python.org |
| Delivered-To | python-list@mail.python.org |
| X-Spam-Status | OK 0.021 |
| X-Spam-Evidence | '*H*': 0.96; '*S*': 0.00; 'subject:Python': 0.05; 'that?': 0.05; 'think,': 0.05; "'a'": 0.07; 'pretend': 0.07; 'base64': 0.09; 'wrong,': 0.09; 'cc:addr:python-list': 0.10; 'suggest': 0.15; 'encoding': 0.15; "'b'": 0.16; 'algorithm.': 0.16; 'encryption': 0.16; 'expert.': 0.16; 'suggestion.': 0.16; 'to:addr:pearwood.info': 0.16; "to:name:steven d'aprano": 0.16; 'wrote:': 0.16; 'later': 0.16; 'say,': 0.18; '>>>': 0.20; 'extension': 0.20; 'cc:2**0': 0.21; 'cc:addr:python.org': 0.21; 'am,': 0.23; '2015': 0.23; 'sat,': 0.23; 'header:In-Reply-To:1': 0.24; 'idea': 0.26; 'data,': 0.27; 'important.': 0.27; 'said,': 0.27; 'message-id:@mail.gmail.com': 0.28; "doesn't": 0.28; 'went': 0.28; "i'm": 0.29; 'appear': 0.29; 'key,': 0.29; 'optional.': 0.29; 'no,': 0.29; 'lines': 0.30; 'that.': 0.30; 'work.': 0.30; 'fri,': 0.31; 'option': 0.31; "can't": 0.32; 'post': 0.32; 'probably': 0.32; 'realize': 0.32; 'point': 0.33; "d'aprano": 0.33; 'steven': 0.33; 'another': 0.34; 'file': 0.34; 'received:google.com': 0.34; 'could': 0.35; 'done': 0.35; 'along': 0.35; 'files,': 0.35; 'something': 0.35; 'really': 0.35; 'asking': 0.35; "isn't": 0.35; 'but': 0.36; 'except': 0.36; 'possible': 0.36; 'data.': 0.36; 'two': 0.37; 'should': 0.37; 'client': 0.37; 'turn': 0.37; 'subject:: ': 0.37; 'delete': 0.37; 'instead': 0.38; "won't": 0.38; 'ones': 0.38; 'say': 0.38; 'pm,': 0.39; 'things': 0.39; 'application': 0.39; 'data': 0.40; 'why': 0.40; 'your': 0.60; 'secure': 0.61; 'back': 0.61; "you've": 0.61; 'more': 0.62; 'management': 0.63; 'p.s.': 0.63; 'here': 0.66; '>>>>>': 0.66; 'encrypted': 0.66; 'promise': 0.66; 'python-list': 0.66; 'subject:Data': 0.66; 'letters': 0.67; 'email,': 0.68; '26,': 0.72; 'add:': 0.84; 'beats': 0.84; 'malicious': 0.84; 'receiver': 0.84; 'solved.': 0.84; 'careful': 0.91; 'received:mail- wi0-x229.google.com': 0.91 |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=I1hzvo1LG75vPcQnfOA0F0tfUItbkQNTorEvOED+v+E=; b=mrM9AC3Qo8W8stnQm8conptvsop3Q1NmbYKA3KjRWFDtkro/6YXoW9+j8A8HGC0PcB 9tt0hunmdw71bHfzYg8L/XFfKXLlYR0VqgX/ffqXHZfSjlsZE77hC1PdPoDeonaYpiR1 moUNZ3rzp51ZZ3VAyCirS3XnHPnt2ITgy66+cC7GpDrMiWHo5o/utemlWcQGJ3vehc5a WLqW/1DYxZ9CVQwjDwKknhfqhH6pp5cVgPjx77KgSM+w32E5D9ksxb2Yo6oYXxLv79n9 YARaF5L1OcZbFMFe28Ev/ljRDMNjmhFVZOM3kHXqH2/hpzVV2r7VVWxiE4xCtiserY+w NAHg== |
| X-Received | by 10.180.20.15 with SMTP id j15mr10126414wie.76.1435457513535; Sat, 27 Jun 2015 19:11:53 -0700 (PDT) |
| MIME-Version | 1.0 |
| In-Reply-To | <558f4b59$0$1655$c3e8da3$5496439d@news.astraweb.com> |
| References | <mmcagn$aa5$1@ger.gmane.org> <q67loadve6lsrh672u47omr04tvqttt6jd@4ax.com> <mailman.29.1435170987.3674.python-list@python.org> <558b7e85$0$1648$c3e8da3$5496439d@news.astraweb.com> <mailman.42.1435206516.3674.python-list@python.org> <558bc912$0$2899$c3e8da3$76491128@news.astraweb.com> <slrnmonkip.1nu.jon+usenet@frosty.unequivocal.co.uk> <558c1a7e$0$1668$c3e8da3$5496439d@news.astraweb.com> <slrnmoo7ev.1nu.jon+usenet@frosty.unequivocal.co.uk> <CAPTjJmqOzLTv9cFFKjV-BLtaFZhEZ4B870ALqNMmanCEN-VqXA@mail.gmail.com> <mailman.89.1435280528.3674.python-list@python.org> <558d86b0$0$1659$c3e8da3$5496439d@news.astraweb.com> <mailman.111.1435349412.3674.python-list@python.org> <558e1ac6$0$1675$c3e8da3$5496439d@news.astraweb.com> <mailman.119.1435377960.3674.python-list@python.org> <558e3fc4$0$1658$c3e8da3$5496439d@news.astraweb.com> <mailman.146.1435437048.3674.python-list@python.org> <558f4b59$0$1655$c3e8da3$5496439d@news.astraweb.com> |
| From | Devin Jeanpierre <jeanpierreda@gmail.com> |
| Date | Sat, 27 Jun 2015 19:11:14 -0700 |
| Subject | Re: Pure Python Data Mangling or Encrypting |
| To | "Steven D'Aprano" <steve@pearwood.info> |
| Cc | "comp.lang.python" <python-list@python.org> |
| Content-Type | text/plain; charset=UTF-8 |
| X-BeenThere | python-list@python.org |
| X-Mailman-Version | 2.1.20+ |
| Precedence | list |
| List-Id | General discussion list for the Python programming language <python-list.python.org> |
| List-Unsubscribe | <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe> |
| List-Archive | <http://mail.python.org/pipermail/python-list/> |
| List-Post | <mailto:python-list@python.org> |
| List-Help | <mailto:python-list-request@python.org?subject=help> |
| List-Subscribe | <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe> |
| Newsgroups | comp.lang.python |
| Message-ID | <mailman.148.1435457522.3674.python-list@python.org> (permalink) |
| Lines | 70 |
| NNTP-Posting-Host | 2001:888:2000:d::a6 |
| X-Trace | 1435457522 news.xs4all.nl 2860 [2001:888:2000:d::a6]:59751 |
| X-Complaints-To | abuse@xs4all.nl |
| X-Received-Bytes | 8220 |
| X-Received-Body-CRC | 3021526710 |
| Xref | csiph.com comp.lang.python:93265 |
Show key headers only | View raw
On Sat, Jun 27, 2015 at 6:18 PM, Steven D'Aprano <steve@pearwood.info> wrote: > On Sun, 28 Jun 2015 06:30 am, Devin Jeanpierre wrote: > >> On Fri, Jun 26, 2015 at 11:16 PM, Steven D'Aprano <steve@pearwood.info> >> wrote: >>> On Sat, 27 Jun 2015 02:05 pm, Devin Jeanpierre wrote: >>> >>>> On Fri, Jun 26, 2015 at 8:38 PM, Steven D'Aprano <steve@pearwood.info> >>>> wrote: >>>>> Now you say that the application encrypts the data, except that the >>>>> user can turn that option off. >>>>> >>>>> Just make the AES encryption mandatory, not optional. Then the user >>>>> cannot upload unencrypted malicious data, and the receiver cannot read >>>>> the data. That's two problems solved. >>>> >>>> No, because another application could pretend to be the file-sending >>>> application, but send unencrypted data instead of encrypted data. >>> >>> Did you stop reading my post when you got to that? Because I went on to >>> say: >> >> At that point I quit in frustration, yeah. >> >>> "Actually, the more I think about this, the more I come to think that the >>> only way this can be secure is for both the sending client application >>> and the receiving client appl to both encrypt the data. The sender can't >>> trust the receiver not to read the files, so the sender has to encrypt; >>> the receiver can't trust the sender not to send malicious files, so the >>> receiver has to encrypt too." >> >> When you realize you've said something completely wrong, you should >> edit your email. > > If both the sender and receiver encrypt the data, how is is "completely > wrong" to say that encrypting data should be mandatory? That isn't what I was calling completely wrong. This is: >>>>> Just make the AES encryption mandatory, not optional. Then the user >>>>> cannot upload unencrypted malicious data, and the receiver cannot read >>>>> the data. That's two problems solved. The user can still upload unencrypted malicious data by writing their own client that doesn't have mandatory AES encryption. You realized this later in the email, apparently, which is why you should have edited your own email to delete your original, insecure, suggestion. :( That said, I appreciate the work you've done here asking for a specific threat model and pushing back on the idea that it's up to python-list to prove something is insecure, not the other way around. That's important. I think, for the same reasons, it's also important to be really careful what cryptosystems we discuss, and not suggest or appear to suggest ones that won't work. P.S. FWIW, the base64 idea has a lot of promise and is probably fundamentally better than a crypto algorithm. With something along the lines of base64 -- say, encoding a file using just the letters 'a' and 'b' -- one might try to make it it literally impossible to write "bad" things to disk, whereas with any crypto, it is always possible to obtain the key, so one has to be careful with key management to prevent/mitigate that. (One might add: why not both? Beats me. I like using extension modules.) P.P.S.: of course, I'm not an expert. -- Devin
Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-24 13:36 -0500
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-25 14:07 +1000
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-24 21:27 -0700
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-06-25 19:25 +1000
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-25 02:41 -0700
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-25 19:57 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-25 10:03 +0000
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-26 01:13 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-25 15:26 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-25 13:58 -0500
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-26 10:33 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-26 10:49 +0000
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-25 19:01 -0600
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-27 03:06 +1000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-26 15:09 -0500
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-26 23:07 +0200
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-26 21:29 +0000
Re: Pure Python Data Mangling or Encrypting Mark Lawrence <breamoreboy@yahoo.co.uk> - 2015-06-26 22:55 +0100
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 00:42 +0200
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-26 16:26 -0700
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-27 00:21 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-26 19:55 -0500
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 07:24 +0200
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-26 19:12 -0500
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-26 15:58 -0600
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-26 19:23 -0500
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-26 23:11 +0200
Re: Pure Python Data Mangling or Encrypting Michael Torrie <torriem@gmail.com> - 2015-06-27 11:02 -0600
Re: Pure Python Data Mangling or Encrypting Paul Rubin <no.email@nospam.invalid> - 2015-06-27 10:45 -0700
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-27 13:38 +1000
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-26 21:05 -0700
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-27 16:16 +1000
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-27 13:30 -0700
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-28 11:18 +1000
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-27 19:11 -0700
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-26 23:47 -0600
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-27 18:38 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 18:53 +1000
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 11:07 +0200
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 19:17 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-27 09:27 +0000
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 12:05 +0200
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 20:16 +1000
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 12:55 +0200
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-27 10:26 +0000
Re: Pure Python Data Mangling or Encrypting Laura Creighton <lac@openend.se> - 2015-06-27 14:27 +0200
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 12:18 +0200
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 21:33 +1000
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-27 08:59 -0600
Re: Pure Python Data Mangling or Encrypting Laura Creighton <lac@openend.se> - 2015-06-27 13:25 +0200
Re: Pure Python Data Mangling or Encrypting Jussi Piitulainen <jpiitula@ling.helsinki.fi> - 2015-06-27 15:23 +0300
Re: Pure Python Data Mangling or Encrypting Laura Creighton <lac@openend.se> - 2015-06-27 14:48 +0200
Re: Pure Python Data Mangling or Encrypting Johannes Bauer <dfnsonfsduifb@gmx.de> - 2015-06-27 11:12 +0200
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-27 09:09 -0600
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-28 03:35 +1000
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-28 03:58 +1000
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-27 14:16 -0600
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-28 13:41 +0000
Re: Pure Python Data Mangling or Encrypting Robert Kern <robert.kern@gmail.com> - 2015-06-27 08:58 +0100
Re: Pure Python Data Mangling or Encrypting Robert Kern <robert.kern@gmail.com> - 2015-06-27 09:07 +0100
Re: Pure Python Data Mangling or Encrypting Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2015-06-27 10:39 -0400
Re: Pure Python Data Mangling or Encrypting Grant Edwards <invalid@invalid.invalid> - 2015-06-27 12:38 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-27 13:22 -0500
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-28 04:51 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-28 09:05 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 11:21 +1000
Re: Pure Python Data Mangling or Encrypting Ian Kelly <ian.g.kelly@gmail.com> - 2015-06-26 23:59 -0600
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-27 09:26 +0000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-27 16:52 +1000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-27 12:08 -0500
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-28 04:50 +1000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-29 15:52 -0500
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-06-30 13:00 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-30 12:19 +0000
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-07-01 04:17 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-07-01 04:33 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-30 18:37 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-07-01 09:38 -0500
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-30 12:39 -0500
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve@pearwood.info> - 2015-07-01 04:59 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-07-01 05:20 +1000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-30 23:25 +0000
Re: Pure Python Data Mangling or Encrypting alister <alister.nospam.ware@ntlworld.com> - 2015-07-01 08:06 +0000
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-28 14:21 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-29 15:46 -0500
Re: Pure Python Data Mangling or Encrypting Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2015-06-29 20:49 +0000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-30 12:43 -0500
Re: Pure Python Data Mangling or Encrypting Gregory Ewing <greg.ewing@canterbury.ac.nz> - 2015-07-02 10:31 +1200
Re: Pure Python Data Mangling or Encrypting Mark Lawrence <breamoreboy@yahoo.co.uk> - 2015-06-26 02:17 +0100
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-26 12:06 +1000
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-26 12:05 +1000
Re: Pure Python Data Mangling or Encrypting Mark Lawrence <breamoreboy@yahoo.co.uk> - 2015-06-26 03:24 +0100
Re: Pure Python Data Mangling or Encrypting Chris Angelico <rosuav@gmail.com> - 2015-06-26 12:29 +1000
Re: Pure Python Data Mangling or Encrypting Joonas Liik <liik.joonas@gmail.com> - 2015-06-25 13:00 +0300
Re: Pure Python Data Mangling or Encrypting Devin Jeanpierre <jeanpierreda@gmail.com> - 2015-06-25 03:18 -0700
Re: Pure Python Data Mangling or Encrypting Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2015-06-25 17:05 +1000
Re: Pure Python Data Mangling or Encrypting Randall Smith <randall@tnr.cc> - 2015-06-25 14:09 -0500
csiph-web