agwa

33 ms·

421.
by agwa 5y ago
> Is there any rationale for this? Do you mean for the TXT record? The rationale for that was performance. I don't know if this rationale was backed up by hard data or just a theoretical concern that HTTPS requests are more expens
422.
by agwa 5y ago
Yeah it seems like EKU could be used for this. But I might be overlooking something.
423.
by agwa 5y ago
Comcast just needs to rotate the ID in the _mta-sts.comcast.net TXT record. That will cause sending mail servers to download the new policy.
424.
by agwa 5y ago
This is a good question. It's a bit more complicated than just using SNI. First is certificate management. There is currently no automated way for mail providers to obtain TLS certificates for domains whose MX records point to them -
425.
by agwa 5y ago
If you never make changes, that will work once it's set up. But if you ever decide to change your mail provider, you'll have to remember to correctly update your MTA-STS policy. If your change to Cloudflare Pages doesn't pro
426.
by agwa 5y ago
Your provider is on the hook for properly configuring TLS on their mail server, but you still need to publish an MTA-STS policy saying who your provider is. Unless your provider provides MTA-STS endpoints that you can CNAME your _mta-sts an
427.
by agwa 5y ago
Right, but now you're on the hook for setting up MTA-STS yourself, which as this post shows is no easy task.
428.
by agwa 5y ago
> Isn't by design it must cache for the amount of time specified in the TXT file? So it has to be durable. Kind of. The max_age in the text file is the max time a cached policy should be used if a new policy can't be retriev
429.
by agwa 5y ago
Speaking as someone who has debugged a considerable number of DNS problems, recurring from the root as described in the post is the only dependable way to determine a domain's authoritative servers. I've seen every alternative
430.
by agwa 5y ago
whois only works for registered domains. It won't help you find the authoritative servers for a subdomain of a registered domain (e.g. subdomain.jvns.ca). It also relies on the registry operating an accurate and reliable whois service
431.
by agwa 5y ago
The MNAME field of the SOA record isn't actually used in DNS resolution so it could contain useless garbage. Recurring from the root as described by the blog post is the only correct way to determine a domain's authoritative serv
432.
by agwa 5y ago
> By the way. This only affect log4j 2.x ( https://github.com/apache/logging-log4j2 ). the log4j 1.x ( https://github.com/apache/log4j ) is not affected. That's not what https://git
433.
by agwa 5y ago
> the vulnerable feature is not in log4j < 2.10 The comment you cited is referring to the option to disable the vulnerable feature, not the vulnerable feature itself. Per https://github.com/apache/logging-log4j2&
434.
by agwa 5y ago
This utility can only perform MitMs if the client doesn't correctly verify the server's identity - e.g. if the user doesn't verify the fingerprint during the first connection, or they override the scary MitM warning. If the
435.
by agwa 5y ago
> I'm actually surprised the ssh protocol doesn't have MITM mitigation built in. Part of the original U2f Spec was that the TLS session State could be hashed and included as part of the client signature, effectively making MITM
436.
by agwa 5y ago
It's possible to set "valid-before" and "valid-after" timestamps on SSH keys in the allowed signers file: https://man.openbsd.org/ssh-keygen#ALLOWED_SIGNERS When validating the SSH signature, Git ca
437.
by agwa 5y ago
A major problem with doing this is that you have to worry about cross-protocol attacks because there is no namespace parameter like there is with SSH signatures. SSH signatures provide the necessary structure to safely use a single key for
438.
CookieMonster: a tool for breaking stateless authentication(ian.sh)
4 points by agwa 5y ago|0 comments
439.
by agwa 5y ago
Yes, if I were made to attend a mandatory training in which my leaders read customer emails saying that the outage caused them to lose trust in the company, I would feel ashamed. That was surely the goal of that exercise. The fact that th
440.
by agwa 5y ago
From the SRE book: "For a postmortem to be truly blameless, it must focus on identifying the contributing causes of the incident without indicting any individual or team for bad or inappropriate behavior. A blamelessly written postmort
441.
by agwa 5y ago
> a mandatory training where leadership read out emails from customers telling us how we let them down and lost their trust Is that normal at Google? Making people feel bad for an outage doesn't seem consistent with the "blame
442.
by agwa 5y ago
No, they don't have to MitM the CA's domain validation request. While they have brief control over the website, they use domain validation method 3.2.2.4.18 (Agreed-Upon Change to Website v2)[1] or 3.2.2.4.19 (Agreed-Upon Change
443.
by agwa 5y ago
Precertificates are optional. Alternatively, the CA can skip creating a precertificate. The certificate would not contain any embedded SCTs. Instead, the certificate is logged using the add-chain endpoint[1], and the returned SCTs are de
444.
by agwa 5y ago
Yes, although the attacker can defer logging the certificate to CT until the moment before the certificate is used in an attack, so you would not have much time to respond.
445.
by agwa 5y ago
> it also wouldn't have been a big deal for them to show something attacker controlled for a little while This is understating the risk. If an attacker obtains control over a website for even a brief period of time, they can go to
446.
MarkMonitor left 60k domains for the taking(ian.sh)
420 points by agwa 5y ago|99 comments
447.
by agwa 5y ago
Here's Street View of the location showing the new, official sign: https://www.google.com/maps/@34.0555469,-118.2565176,3a,75y,...
448.
by agwa 5y ago
Here's street view from the Cresta Dam: https://www.google.com/maps/@39.8762603,-121.3726288,3a,50.4... You can see the Bucks Creek 1101 line in the background crossing the river and then going uphill.
449.
by agwa 5y ago
That photo shows a transmission line (230 kV according to OpenInfraMap[1]). The line that started the fire was a 12kV distribution line[2]. I think this is one of the poles on this distribution line: https://www.google.com/
450.
by agwa 5y ago
X509's subject alternative name extension has nothing to do with TLS' SNI extension. SNI does not have a mechanism for locally-defined name types akin to X509's OtherName.

More ›