From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.user/18733 Path: news.gmane.org!.POSTED!not-for-mail From: Alberto Luaces Newsgroups: gmane.emacs.gnus.user Subject: Re: Gmane with Gnus first timer Date: Thu, 28 Sep 2017 13:26:30 +0200 Message-ID: <878tgzt66x.fsf@eps142.cdf.udc.es> References: <877ewk41ll.fsf@gmail.com> <874lrounzu.fsf@eps142.cdf.udc.es> <87k20j3oeo.fsf@gmail.com> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Trace: blaine.gmane.org 1506598010 16761 195.159.176.226 (28 Sep 2017 11:26:50 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Thu, 28 Sep 2017 11:26:50 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) To: info-gnus-english@gnu.org Original-X-From: info-gnus-english-bounces+gegu-info-gnus-english=m.gmane.org@gnu.org Thu Sep 28 13:26:46 2017 Return-path: Envelope-to: gegu-info-gnus-english@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dxWxn-0003rP-DB for gegu-info-gnus-english@m.gmane.org; Thu, 28 Sep 2017 13:26:43 +0200 Original-Received: from localhost ([::1]:58544 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dxWxu-0007mb-T6 for gegu-info-gnus-english@m.gmane.org; Thu, 28 Sep 2017 07:26:50 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:33759) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dxWxn-0007mM-Ui for info-gnus-english@gnu.org; Thu, 28 Sep 2017 07:26:44 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dxWxj-0004pK-Rj for info-gnus-english@gnu.org; Thu, 28 Sep 2017 07:26:43 -0400 Original-Received: from [195.159.176.226] (port=35163 helo=blaine.gmane.org) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dxWxj-0004or-K1 for info-gnus-english@gnu.org; Thu, 28 Sep 2017 07:26:39 -0400 Original-Received: from list by blaine.gmane.org with local (Exim 4.84_2) (envelope-from ) id 1dxWxY-0002xb-5h for info-gnus-english@gnu.org; Thu, 28 Sep 2017 13:26:28 +0200 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 41 Original-X-Complaints-To: usenet@blaine.gmane.org Cancel-Lock: sha1:Xr/fBd6uPVcucZpuxQ6FFOyXM6U= X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 195.159.176.226 X-BeenThere: info-gnus-english@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Announcements and discussions for GNUS, the GNU Emacs Usenet newsreader \(in English\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: info-gnus-english-bounces+gegu-info-gnus-english=m.gmane.org@gnu.org Original-Sender: "info-gnus-english" Xref: news.gmane.org gmane.emacs.gnus.user:18733 Archived-At: Hi Maxim, Maxim Cournoyer writes: > Are you sure the data obtained from news.gmane.org is not funneled > through TLS? And why would Emacs warn about Gmane TLS problems > otherwise? The Gnus manual has this to say about the > `nntp-open-network-stream': > > This is the default, and simply connects to some port or other on the > remote system. If both Emacs and the server supports it, the connection > will be upgraded to an encrypted STARTTLS connection automatically. > Yes, you are right in the TLS part, but I was referring to the trust you are putting into a certificate you have also downloaded in an insecure way. The certificate system only works if it is signed by someone you already trust. If the certificate is self-signed, the only safe way to check that it is the valid one would be to exchange fingerprints with the owner by means of a different secure channel (telephone, USB exchange...) Otherwise you can suffer from a man-in-the-middle attack even the whole communication is encrypted. > >> In this case I think it doesn't really matter, since all the lists and >> postings are public. > > Since it is public, you are correct that it doesn't play a role in > privacy, but it does in making sure that the communication link between > you and the Gmane server is not susceptible to man-in-the-middle > attacks, which is a nice property. In theory Malefoy could otherwise > turn a peaceful discussion into a flame war or whatnot ;). Yes, MITM is still possible, as described before. In this case there is no solution if you do not have some kind of trust network before (being it gpg, SSL or something else). -- Alberto