diafygi

56 ms·

511.
by diafygi 11y ago
The standalone authenticator still requires (1) installing/running the letsencrypt client on your production server, (2) letting it run as root, and (3) letting it access your private keys. My script requires none of these things.
512.
by diafygi 11y ago
FYI, if you don't want to install the official Let's Encrypt client on your production server, I created a simple python script that will automate the ACME process for you. It doesn't have to run on your server, and it doesn&
513.
An Open Letter to News Sites(daylightpirates.org)
2 points by diafygi 11y ago|0 comments
514.
by diafygi 11y ago
I've had a few conversations with other advocacy nonprofits who are not using https, even when they know they are being targeted for surveillance. It seems the biggest reason they don't switch is because their IT staff would bitch
515.
by diafygi 11y ago
The demo video is pretty convincing. https://youtube.com/watch?v=9wiMG-oqKf0
516.
iOS 8.3 Mail.app inject kit(github.com)
200 points by diafygi 11y ago|38 comments
517.
by diafygi 11y ago
So I guess the lesson is that if you want to have a bigger impact when you blow the whistle, you need hard documentation and evidence. You can't just tell the world there is a bad thing happening. You need to show them the paper that p
518.
by diafygi 11y ago
From the article: ISRG - Internet Security Research Group - Let's Encrypt was in stealth mode for a while before they announced the project, and they used this generic name as the official certificate authority so they could fly unde
519.
by diafygi 11y ago
I believe that Let's Encrypt will only be doing DV.
520.
by diafygi 11y ago
Windows, OSX, Debian, and NSS (Firefox) all have it in their root trust stores. Dunno about mobile. EDIT: I can't find it on my Android phone (4.3)... EDIT2: Found it! Was added in 2010 under the name Digital Signature Trust. https:&#
521.
by diafygi 11y ago
Here's the details for the Intermediate 2 cert: $ openssl x509 -in letsencryptauthorityx2.txt -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 96:36:4c:a7:38:0b:e4:8b:dc:90:c6:
522.
by diafygi 11y ago
Here's the details for the Intermediate 1 cert (I'm not seeing the cross signature): $ openssl x509 -in letsencryptauthorityx1.txt -text -noout Certificate: Data: Version: 3 (0x2) Serial N
523.
by diafygi 11y ago
Here's the details for the Root cert: $ openssl x509 -in isrgrootx1.txt -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 82:10:cf:b0:d2:40:e3:59:44:63:e0:bb:63:82:8b:00
524.
by diafygi 11y ago
> "Aircraft surveillance has become an indispensable intelligence collection and investigative technique which serves as a force multiplier to the ground teams," the FBI said in 2009 when it asked Congress for $5.1m for the pr
525.
by diafygi 11y ago
So just to clarify, there's two problems for sysadmins to fix, right? 1. Your HTTPS cipher list may include EXPORT ciphers that make the initial DH bits low enough to break. 2. Your ephemeral DH parameters in your EDH ciphers may be lo
526.
by diafygi 11y ago
Hulu used to be able to circumvent ad-blockers (not sure if they still do) by making their ad content indistinguishable from normal content. For example, a normal TV show segment would be served from: http://hulu.com/v/
527.
by diafygi 11y ago
Man, there's a lot of references to the ACME client. "The contents of Your Certificates will be based on the information You or Your ACME Client Software sends to ISRG." "Your Key Pair (Public and Private Keys) will b
528.
by diafygi 11y ago
I've been fighting the fight to be more proactive about signature verification, but there's little interest in changing the status quo. Relevant GPG thread: https://lists.gnupg.org/pipermail/gnupg-users/2
529.
by diafygi 11y ago
It is highly likely that this is the work of a troll. The RSA subkey that was factored has an invalid self-signature in hpa's public key[1], which means that it wasn't really hpa who added the subkey. Since the sks-keyserver pool
530.
by diafygi 11y ago
Can you please disclose the key ids? Are they the same instances of inserting subkey under someone's public key with an invalid self-signature[1]? If so, it seems that this attack is exploiting the fact that the sks-keyserver pool does
531.
by diafygi 11y ago
One of my side projects: https://github.com/diafygi/openpgp-python Not fully functional yet, but was able to convert this public key to json. I manually removed the non-self signature packets for the gist.
532.
by diafygi 11y ago
The factored keypair in question is actually a subkey on HPA's public key. However, it appears that the self signature (which is a signature on the hash of the main public key and the subkey) does not match the hash_check. The issuer o
533.
by diafygi 11y ago
The SKS keyserver pool (which keys.gnupg.net alias's to) doesn't do any cryptographic verification, even verifying self-signatures, before upload. The software just checks to see if the format is valid. It's up to the clients
534.
by diafygi 11y ago
Yes! It looks like someone inserted a broken subkey with an invalid signature into the keyserver. If your software didn't validate subkey signatures, you could very well think that a package was signed by HPA. Alternatively, it could b
535.
by diafygi 11y ago
Hmmm, can't seem to find any links for the prices you mentioned. Citations?
536.
by diafygi 11y ago
Examples? The cheapest I can find is the ALCATEL onetouch Evolve 2 for $19 at MetroPCS[1]. [1]: https://www.metropcs.com/phones/details/alcatel-onetouch-evo...
537.
Minor updates to your Google sign-in experience(productforums.google.com)
1 points by diafygi 11y ago|0 comments
538.
Santa Clara County Officials Pull the Plug on Stingray Cellphone Tracking Tech(sanfrancisco.cbslocal.com)
4 points by diafygi 11y ago|0 comments
539.
by diafygi 11y ago
FYI, the fake announcement post was really fun to write: ------ $150 million investment from Andreessen Horowitz! We are extremely excited to announce our new funding from some long time friends in venture capital, Andreessen Horowitz. They
540.
by diafygi 11y ago
Yes, it does! This basically overrides the path to the commands and MITMs the pricing counter.

More ›