response 20 of 40:

Dec 1 14:29 UTC 2013

You have to log in to vote, anyway.  So I don't see the issue with the
certificate on the web page.

response 22 of 40:

Dec 1 17:48 UTC 2013

The whole reason that a certifying authority sets a "NotValidAfter" attribute
is to limit the time during which an adversary can subvert or snoop the
traffic in-flight, whether because the adversary stole the key (and the
inattentive system operators did not notice) or the adversary guessed the key.

Allowing the certificate to lapse not only shows neglect by the organization
operating the system that asserts the certificate, but exposes all ussers of
the interface that asserts the certificate to having their in-flight traffic
(including credentials, non-public information or other traffic) stolen or
changed on the wire. 

I am  not concerned that I have to enter my credentials in order to vote; I
would expect and hope to have to (a reasonable control). The concern is that
an adversary on or off the system could intercept my attempt to vote and
either view the credentials used to put in the vote or change my vote
in-flight. 

I work as a registration authority for an internal certifying authority and
deal with this foolishness in my day job. 


 -DTK

response 24 of 40:

Dec 1 18:46 UTC 2013

A self-signed certificate exacerbates the problem, because there is no way
to tell if the certificate was in fact signed by the system itself, or by an
adversary posing as the system. Since Grex's self-signed certificate is not
by default in browsers' trust-stores, there would be no basis for trusting
it, and without an out-of-band mechanism to convey the certificate for
establishing trust, people would assume it has been compromised. The value
of a CA (id eddum Certifying Authority) is that it anchors trust to a handful
(actually over a hundred) organizations whose primary business is serving as
trust providers, and whose root certificate (trust anchor) is included with
browsers. CAs participate in what is known as the CA-Browser Forum, and are
held to a high level of scrutiny. They in-turn scrutinize signing requests,
and for highly trusted certificaes (Extended Validation (green address bar)),
they perform extensive research to validate that the certificate was requested
only by the entity that claims to be, and not by an imposter (can take up to
three weeks for a new second-level domain; usually involves company
letterhead, interviewing named company officers, whois registration, etc).
To make the analogy, they serve as notary public for the PKI, and their
activity is cryptographically verifyable. 

no, I do not think that the Grex private key has been pwned and taken home,
but training people to ignore certificate warnings is in itself dangerous,
as it lowers everybody's security awareness, and is poor OPSEC. Furthermore,
the longer a key-pair hangs out there, the greater the likelihood of it being
silently pwned, hence the expiration date on every certificate, giving a known
(planned) end of usefulness. 

response 26 of 40:

Dec 1 22:58 UTC 2013

I haven't looked at the Grex bylaws recently, but I presume there is some
mechanism for filling vacancies.  There will now be two vacancies for the
Board to fill. This will be simpler than restarting the voting - which, in
fact, is not provided for the the bylaws. 

response 28 of 40:

Dec 1 23:59 UTC 2013

Tod, do you accept this belated nomination?
 
If so, we can discuss what to do about it in re the current election.

response 30 of 40:

Dec 2 00:47 UTC 2013

Thanks, Tod.   I hope we can get you on the ballot for this election.
I'm checking with our vote admin.  It won't affect the election of
anyone else since we have four slots open.

response 32 of 40:

Dec 2 21:27 UTC 2013

Ignore them.  It's time.  Past time, actually.

response 34 of 40:

Dec 3 04:17 UTC 2013

Thanks Kent

response 36 of 40:

Jan 12 02:04 UTC 2014

I've made an unofficial, provisional count of the votes in the regular
election for the Board of Directors for 2014. Six people voted. Five voted
for both candidates, and one voted for only one candidate. So if any of the
five who voted for both are members, and the candidates are members, then the
two candidates were elected.

The Treasurer has not provided a list of the members as of the end of the
voting period, so I cannot make an official count.

response 38 of 40:

Feb 25 03:59 UTC 2014

Thanks for doing the counting, gelinas.  Time to organize
another special election.

response 40 of 40:

Feb 25 15:31 UTC 2014

You're welcome.  There were a lot of membership expirations toward the end
of the year, and then a lot of renewals in January, as I understand the
situation.