6 ms·

Beside Moxie, is anyone else having success expanding the use of encryption?

by nxzero 11y ago

cpeterso 11y ago
Let's Encrypt has issued 1.7 million free certificates for more than 3.8 million websites over the past six months. Let's Encrypt also enables companies like WordPress and DreamHost to offer free, easy HTTPS to their customers. https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors...
- e12e 11y ago
  But if Letsencrypt were served with an NSL demanding access to their signing keys, how would we know?
  - zrm 11y ago
    That isn't what it's for. You can assume the government (really any government) has control over at least one CA. What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subjecting their users to self-signed certificate warnings. A government could still MITM the connection but that requires an active attack rather than passive surveillance. And active attacks are subject to detection. So it protects against undetectable mass surveillance.
  - lorenzhs 11y ago
    That would allow the government to issue new certificates, not to decrypt traffic to sites using letsencrypt certificates. Active man in the middle attacks are rather noisy, and things like HPKP exist to prevent such attacks
  - DenisM 11y ago
    Cert pinning makes it a difficult and expensive attack to carry out.
- asddubs 11y ago
  i wish they would offer wildcard subdomain support (forget the official term right now) - for services which offer subdomains to their users. I run one such service for free, and would love to offer HTTPS to my customers, but don't want to add yet another running cost for something I don't profit from
CiPHPerCoder 11y ago
I've been working on teaching developers to not just use encryption, but to use it properly, for the past year or so. I'd like to think it's making a difference, but only time will tell.
- RadioactiveMan 11y ago
  I have been through some of your material and it has been a joy to read.
- nxzero 11y ago
  Unable to find a link and your site appear to be down too.
  - CiPHPerCoder 11y ago
    Yikes. Sorry about that, something went wrong with my init scripts and our server rebooted earlier. It's up again and I'm looking into the problem. Our blog posts in particular: https://paragonie.com/blog/category/security-engineering https://paragonie.com/blog/category/security-engineering A reading list we maintain for application security (and some crypto stuff): https://github.com/paragonie/awesome-appsec https://github.com/paragonie/awesome-appsec
    - nxzero 11y ago
      How do you filter which topics you cover and don't cover? Same for resource per topic. Thanks!
      - CiPHPerCoder 11y ago
        For our blog posts: We don't have an official rubric, but we try to emphasize topics that are immediately useful and provide simple steps towards better long-term security for anyone who reads it. For example, developers know not to roll their own cryptography, but how can someone who has never rolled their own crypto evaluate existing libraries? There are a lot of bad ones out there, and "I didn't roll my own crypto" doesn't equate to "I used a well-studied library thought to be secure by industry experts". Consequently, we delved into specific recommendations and explained why we include them in our list. https://paragonie.com/blog/2015/11/choosing-right-cryptography-library-for-your-php-project-guide https://paragonie.com/blog/2015/11/choosing-right-cryptograp... (Historical context, this was published after I discovered CVE-2015-7503 in Zend Framework 2. A lot of my peers said it was good, but I don't recommend code until I've audited it. Lo and behold, I found a problem with their RSA implementation.) For our reading list: We focus on application security, not physical security (e.g. data center security, full disk encryption), social engineering (e.g. phishing, scamming), or system security (e.g. malware and OS-level exploit mitigation). Application security can encompass cryptography, information theory, etc. but the target audience is programmers. Material for any programming language will be considered for inclusion, but some absurd ones (e.g. Brainfuck) will probably be declined.
sreitshamer 11y ago
Yes. I work on a backup app (Arq) that encrypts before uploading the data.

Beside Moxie, is anyone else having success expanding the use of encryption?

by nxzero 11y ago

Beside Moxie, is anyone else having success expanding the use of encryption?

Let's Encrypt has issued 1.7 million free certificates for more than 3.8 million websites over the past six months. Let's Encrypt also enables companies like WordPress and DreamHost to offer free, easy HTTPS to their customers. https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors...

e12e 11y ago
But if Letsencrypt were served with an NSL demanding access to their signing keys, how would we know?
- zrm 11y ago
  That isn't what it's for. You can assume the government (really any government) has control over at least one CA. What Let's Encrypt does against state-level actors is let people easily use HTTPS instead of HTTP without subjecting their users to self-signed certificate warnings. A government could still MITM the connection but that requires an active attack rather than passive surveillance. And active attacks are subject to detection. So it protects against undetectable mass surveillance.
- lorenzhs 11y ago
  That would allow the government to issue new certificates, not to decrypt traffic to sites using letsencrypt certificates. Active man in the middle attacks are rather noisy, and things like HPKP exist to prevent such attacks
- DenisM 11y ago
  Cert pinning makes it a difficult and expensive attack to carry out.
asddubs 11y ago
i wish they would offer wildcard subdomain support (forget the official term right now) - for services which offer subdomains to their users. I run one such service for free, and would love to offer HTTPS to my customers, but don't want to add yet another running cost for something I don't profit from

CiPHPerCoder 11y ago

I've been working on teaching developers to not just use encryption, but to use it properly, for the past year or so. I'd like to think it's making a difference, but only time will tell.

RadioactiveMan 11y ago
I have been through some of your material and it has been a joy to read.
nxzero 11y ago
Unable to find a link and your site appear to be down too.
- CiPHPerCoder 11y ago
  Yikes. Sorry about that, something went wrong with my init scripts and our server rebooted earlier. It's up again and I'm looking into the problem. Our blog posts in particular: https://paragonie.com/blog/category/security-engineering https://paragonie.com/blog/category/security-engineering A reading list we maintain for application security (and some crypto stuff): https://github.com/paragonie/awesome-appsec https://github.com/paragonie/awesome-appsec
  - nxzero 11y ago
    How do you filter which topics you cover and don't cover? Same for resource per topic. Thanks!
    - CiPHPerCoder 11y ago
      For our blog posts: We don't have an official rubric, but we try to emphasize topics that are immediately useful and provide simple steps towards better long-term security for anyone who reads it. For example, developers know not to roll their own cryptography, but how can someone who has never rolled their own crypto evaluate existing libraries? There are a lot of bad ones out there, and "I didn't roll my own crypto" doesn't equate to "I used a well-studied library thought to be secure by industry experts". Consequently, we delved into specific recommendations and explained why we include them in our list. https://paragonie.com/blog/2015/11/choosing-right-cryptography-library-for-your-php-project-guide https://paragonie.com/blog/2015/11/choosing-right-cryptograp... (Historical context, this was published after I discovered CVE-2015-7503 in Zend Framework 2. A lot of my peers said it was good, but I don't recommend code until I've audited it. Lo and behold, I found a problem with their RSA implementation.) For our reading list: We focus on application security, not physical security (e.g. data center security, full disk encryption), social engineering (e.g. phishing, scamming), or system security (e.g. malware and OS-level exploit mitigation). Application security can encompass cryptography, information theory, etc. but the target audience is programmers. Material for any programming language will be considered for inclusion, but some absurd ones (e.g. Brainfuck) will probably be declined.

sreitshamer 11y ago

Yes. I work on a backup app (Arq) that encrypts before uploading the data.