agwa

55 ms·

631.
by agwa 10y ago
Batch attacks: https://blog.cr.yp.to/20151120-batchattacks.html
632.
by agwa 10y ago
Update: Finch is always disabled in Chromium builds. Disabling it was not a decision by distro maintainers. Supposedly, the following command line options will enable it, but it seems like just upgrading is a better option: --variations-se
633.
by agwa 10y ago
I can't speak for Symantec, but folks use SSLMate (which resells Comodo) because of the customer support, the wildcard certificates, the lack of rate limits, and the central management of certificates (which integrates with Cert Spotte
634.
by agwa 10y ago
The expiration was designed back when Certificate Transparency was only required to make Extended Validation certificates display a green bar. The intention was never to make certificates fail entirely when a Chrome build was more than 10
635.
by agwa 10y ago
Author here. It has gotten kind of hard to follow what has happened, so here's a chronology: 1. In September, Chrome 53 was released, which enabled mandatory Certificate Transparency for Symantec certificates due to Symantec's hi
636.
by agwa 10y ago
> There are clearly other ways of ending up with a certificate that triggers this. The update at the top of the blog post should explain why this error message is triggered even with an unredacted certificate.
637.
by agwa 10y ago
I'm not aware of any changes in the next release that would prevent this from working. In 2014, the project voted on whether packages could require a specific init system. My read of the results[1] is that a significant minority of th
638.
by agwa 10y ago
On Debian: apt-get install sysvinit-core systemd-sysv- reboot To prevent it from coming back, create the file /etc/apt/preferences.d/no-systemd.pref containing: Package: systemd-sysv Pin: origin * Pin-Pr
639.
by agwa 10y ago
Although I don't agree with all of the analysis in this post, it's pretty reasoned and balanced on the whole. However, it's arguing a strawman that systemd should have been written in a memory-safe language. I never argued t
640.
by agwa 10y ago
> I find it hard to understand why people "expect" perfection from code written by humans. Shit breaks, people make mistakes, deal with it. Is anyone in their right minds to expect perfectly written software, while at the same
641.
Update on transition of the Verizon roots and issuance of SHA1 certificates(mail-archive.com)
1 points by agwa 10y ago|0 comments
642.
by agwa 10y ago
Indeed it will. In fact, I'm not convinced U2F adds any meaningful security over a good password manager.
643.
by agwa 10y ago
U2F knows what domain you're using it with, and won't send an authentication token for google.com to phisher.com.
644.
by agwa 10y ago
Then how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing feature.
645.
by agwa 10y ago
How does it help? Can't the attacker make a query to Google for the user image and display it on the phishing page?
646.
by agwa 10y ago
Only if you use a U2F hardware token. 2FA using SMS or a smartphone app merely raises the bar for phishing: the attacker can forward the password along to the real service, prompt the user for the 2FA code, forward that along too, and then
647.
by agwa 10y ago
You're wrong. As you can see on page 31 of RFC6376, the signature clearly covers a hash of the message body: https://tools.ietf.org/html/rfc6376#page-31 It's possible to hash only a prefix of the body by spe
648.
by agwa 10y ago
Also: https://groups.google.com/forum/#!topic/mozilla.dev.security... https://cabforum.org/pipermail/public/2016-January/006519.ht... https://groups.google.com/d&#x2
649.
by agwa 10y ago
Google is not doing this. CloudFlare made a deal with Comodo to issue (non-backdated) SHA-1 certificates from a "legacy" root that is mostly no longer trusted by modern clients. Symantec and Entrust are also issuing SHA-1 certific
650.
by agwa 10y ago
No need for you to apologize - you never said systemd was at fault. (Neither did I - the point is that systemd has to be careful with its inputs, since they won't necessarily be coming from someone with root shell access.)
651.
by agwa 10y ago
This is exactly my argument! Thank you.
652.
by agwa 10y ago
Hmmm... I've repro'd on v215, v229, and v230, although only on Debian and Ubuntu. The bug has been in systemd upstream since v209 as far as I can tell by reading the code.
653.
by agwa 10y ago
My hosting provider thought I was under DDoS attack and started aggressively throttling port 443. I failed over to my backup provider, probably permanently.
654.
How to Crash Systemd in One Command(agwa.name)
224 points by agwa 10y ago|184 comments
655.
by agwa 10y ago
The incident was terrible, but it is not a reflection on how their CA is run. They run a trustworthy CA and employ some really awesome and competent people (e.g. Rob Stradling) who actively contribute to improving the Web PKI, such as by (
656.
by agwa 10y ago
A recent combination of Apache and OpenSSL has support for certificate switching based on key algorithm. You can serve an ECDSA+SHA2 certificate to clients that support ECDSA, and an RSA+SHA1 certificate to clients that don't. I&#x27
657.
by agwa 10y ago
I'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: https://sslmate.com Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.
658.
by agwa 10y ago
You serve them a SHA-2 certificate. (In TLSv1.2 the client's supported hash algorithms are included in the handshake. Clients that don't support TLSv1.2 are probably fine with SHA-1. You can also use heuristics based on the cip
659.
by agwa 10y ago
The decision by Mozilla has absolutely no bearing on Chromium. Although Chromium indirectly uses the NSS root store when run on a Linux distro that uses the NSS root store, the logic proposed by Mozilla will be implemented at a higher laye
660.
by agwa 10y ago
Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/CA:Policy_Participants Chrome does indeed use the platform

More ›