jasonh3

4 ms·

1.
by jasonh3 7y ago
A mechanism to constrain root CAs to particular URLs/domains was proposed in firefox a while ago[0]. Perhaps an idea whose time has now come? It seems like the principle of least privilege could easily be applied to the CA system rathe
2.
by jasonh3 7y ago
Somewhat related: if there were a shared password between the client and server, Password Authenticated Key Exchange techniques [0] could offer protection even when the server CA was compromised. PAKEs use zero-knowledge proof techniques to
3.
by jasonh3 7y ago
This feels a lot like a more production-y version of Ryoan (OSDI '16). https://www.usenix.org/conference/osdi16/technical-sessions/...
4.
by jasonh3 7y ago
When I first saw this post, I got excited that someone had finally addressed the side channel from 17 years ago, which gathered inter-packet timing from ssh packets (and the fact that passwords are not echo'd) to a) detect when passwor
5.
by jasonh3 8y ago
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :) * : Last I checked, the two most popular Linux distros I'm famili
6.
by jasonh3 8y ago
I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer. > How many scenarios are there where a com
7.
by jasonh3 8y ago
It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more than fix