0x0

74 ms·

751.
by 0x0 9y ago
Apparently you can even be denied Global Entry for buying from Amazon: https://www.racked.com/2018/1/8/16849298/amazon-counterfeits...
752.
by 0x0 9y ago
Presumably, even if you had root on the reseller website, you would need to wait for the domain owner to actually perform a domain validation before the actual CA's system would deliver any certificates?
753.
by 0x0 9y ago
Surely the actual CA has a database of certificates it has issued and by which reseller?
754.
by 0x0 9y ago
Unless you revoke all the certs issued through that channel/reseller - the legitimates would be collateral damage but you'd also get rid of any illegitimate ones?
755.
by 0x0 9y ago
Yes, but you could fool the user with an error message so the user tries again and let it through unmodified? (Hide the fact that a cert was actually issued already)
756.
by 0x0 9y ago
1. User validates domain and submits csr 2. Rootkit swaps out csr with one of its own whose private key is under its control and submits upstream to the CA 3. CA signs a cert because the domain was validated 4. Rootkit receives valid cert f
757.
by 0x0 9y ago
CEO SEO?
758.
by 0x0 9y ago
Yes, but after the damage was done and only because the damage happened to be uncovered.
759.
by 0x0 9y ago
If the server was rooted, couldn't an attacker silently intercept and swap out a csr with their own during domain validation, and thus get certificates approved based on fraudulent csr where the corresponding private keys are controlle
760.
by 0x0 9y ago
Should count as probable cause for revoking the remaining 27k certificates then, no? It's not unreasonable to think someone has been exploiting this for years, siphoning any private key passing through?
761.
Trustico Code Injection as root(groups.google.com)
2 points by 0x0 9y ago|0 comments
762.
by 0x0 9y ago
Sorry, I was mostly having the various commercial EV services in mind for that comment. Thanks for all the great work your team seems to be consistently doing!
763.
by 0x0 9y ago
Yep, it's a race to the bottom for CAs to perform the absolute minimum work necessary, because otherwise competitors come in and make things easier for customers. Paying a premium for the services of a stricter CA currently has no bene
764.
by 0x0 9y ago
I found your last paragraph especially well phrased! You're also on point regarding the CAA records. But to me the current system still feels too reactionary. I'd love to see a system where we need to put less trust in all third p
765.
by 0x0 9y ago
Maybe, but today's DV PKI is already trusting DNS 100%, since certificates are issued based on using DNS responses to validate the certificate request. If you don't trust the governing body of a specific ccTLD, for example, you ar
766.
by 0x0 9y ago
Just like Robin Hood then? :)
767.
by 0x0 9y ago
See, that requires trusting that all CAs actually respect the CAA records. AFAIK, CAA records aren't validated by end-user client software during SSL negotiation. I would love to see some technical measure implemented where DV SSL cert
768.
by 0x0 9y ago
The DV CA space is such a mess. I still wish DV certificate issuance was the responsibility of the domain registrar, with technical measures taken to prevent competing registrars from misissuance. This way, you don't need to play whack
769.
by 0x0 9y ago
Maybe the battery slowdown scandal patch, aka iOS 11.3, and/or a battery replacement will help with that. I used to have a 6+ as well and it felt super laggy since iOS 11. Will be interesting to check with the person who was handed my
770.
by 0x0 9y ago
It's like the three major areas of programming where "things may appear to work but are in fact dangerously broken in hidden ways" converged. Compared to other software where the worst case is often crashing or not working, u
771.
by 0x0 9y ago
Fonts are hard. I don't think CoreText is worse than others, most vendors seem to have a history of horrors, and at least it's not rendering fonts in a kernel driver like Windows did(!?) - see for example the Project Zero series o
772.
by 0x0 9y ago
I guess that's a +1 for why new iPhones are changing over to Intel LTE chips
773.
by 0x0 9y ago
Looks like a Referer header prank
774.
by 0x0 9y ago
I think you're missing the point of the article. The article is a demonstration of a less known feature in windows95 that let you run windows 3.1, but offered a button to "switch to windows95" at runtime (i.e. switch to somet
775.
by 0x0 9y ago
On the other hand, the Darwin kernel also powers iOS, and Apple seems to be eager to keep the system secure so that the App Store appears trustworthy. While a local privilege escalation might seem dull on macOS, the fact that the same flaw
776.
by 0x0 9y ago
Related: http://www.tetherreport.com/
777.
by 0x0 9y ago
Even non-supervised iPhones can be set up with "Restrictions" where location services are disabled locked behind a passphrase. Surely an iPhone in supervised mode offers similar restrictions in any enterprisey MDM solution.
778.
by 0x0 9y ago
So if the one seller counts on being able to buy the other seller's book if the first seller actually makes a sale, what happens if someone buys both listings at the same time and the higher priced listing is unable to source the item?
779.
by 0x0 9y ago
Haha nice Markov Chain going there
780.
by 0x0 9y ago
At the very least I'm sure the script checks a few simple conditions before unleashing the miner, such as current date, ip, language prefs, possibly a "go/no-go" boolean hosted on some random webserver, to evade any pre-

More ›