From: security curmudgeon (jericho[at]attrition.org)
To: wkenzie@securikai.com
Date: Wed, 25 Jan 2012 18:59:40 -0600 (CST)
Subject: You can mail me here...

... and we don't need PGP for it.

Given the contact address at the bottom of the article is 'errata@attrition.org', 
and any rational search would find this one first, I am not sure why you went 
searching for any other address.

jericho

From: security curmudgeon (jericho[at]attrition.org)
To: "Arthur (Wesley) Kenzie" (wkenzie@securikai.com)
Date: Fri, 27 Jan 2012 15:40:21 -0600 (CST)
Subject: Re: You can mail me here...


On Thu, 26 Jan 2012, Arthur (Wesley) Kenzie wrote:

: No need for PGP? or GPG? I am uncertain what you mean. What about
: authentication? And tamper resistance? Or am I just naive to think it
: actually works as advertised?

You are naive to think I care that much about someone tampering with your
mail in transit to me. You are naive to think someone would spoof mail
from you to me in this manner, given the timing. Further, you are really
naive, bordering on "criminally stupid" not fully understanding the
implications of PGP signing all of your mails.

: I see that your orgs have relied on PKI in the past:

I see that you make wildly stupid assumptions. That, or you simply do not
understand the meaning of the word "relied". Just because someone has a
PGP/GPG key, doesn't mean they rely on it, or use it for their hundreds of
mails every day.

: But aside from that, I wanted to know how I might get kicked off your
: watch list?

Stop trying to extort companies for starters.

: Confidentiality Statement: This e-mail, including attachments, includes
: confidential and/or proprietary information, and may be used only by the
: person or entity to which it is addressed. If the reader of this e-mail
: is not the intended recipient or his or her authorized agent, the reader
: is hereby notified that any dissemination, distribution or copying of
: this e-mail is prohibited. If you have received this e-mail in error,
: please notify the sender by replying to this message and delete this
: e-mail immediately. Thank you.

Really? Yes, very naive.

From: security curmudgeon (jericho[at]attrition.org)
To: "Arthur (Wesley) Kenzie" (wkenzie@securikai.com)
Date: Fri, 27 Jan 2012 15:43:24 -0600 (CST)
Subject: Re: Fwd: You can mail me here...


On Fri, 27 Jan 2012, Arthur (Wesley) Kenzie wrote:

: Are you aware of who owns atrition.org and attrittion.org? They appear
: to have been registered on Dec 12, 2011. Are you atritionorg@yandex.ru
: or is that someone else? Domaintools says that atritionorg@yandex.ru
: owns 4 domains, so I presume that means 2 others besides these 2.

I don't know him by name, but I know generally of him. It is a standard
typosquatting attack leading to a domain that has a bunch of false
information about me that is trivial to verify as false. But, that type of
attack isn't mean to sway intelligent people.

I imagine you were looking to snatch that up to make a point or try to
sell the domain to me. Tough luck, another douchebag beat you to it.
Attrition.com has received a lot more of our mail historically than any
other domain anyway. And I don't care that they do either. Feel free to
snap up any domain you want that looks or smells like this one.

: I have nothing to do with either/any of these domains. I was just
: checking today to see what came up. And I am just passing this on to you
: in case you didn't know already, and might want to know.

Yes, I am well aware of it and a lot more related to that domain.