pfg

73 ms·

271.
by pfg 9y ago
Other countries have copyright laws too. Most of these laws have some kind of notice-followed-by-takedown protocol, and my understanding is that in many jurisdictions, a DMCA takedown notice qualifies as such a notice. Probably the only maj
272.
by pfg 9y ago
Based on my logs, the outage seems to have started around 9 am UTC, with services recovering around 10:50 am UTC.
273.
by pfg 9y ago
OVH lets you use the advertised bandwidth 24/7, if you wish to do so. Naturally, this doesn't replace a CDN, and their peering isn't the best, so some routes might be congested and won't be that fast. I have no experienc
274.
by pfg 9y ago
Password managers with browser extensions are a good fix for this too. If you're used to entering your password only through the extension, not being able to do that on a login screen would be a big warning sign. Admittedly, these exte
275.
by pfg 9y ago
Malware is a game-over scenario either way. It can simply steal your session keys or send requests from your browser with an active session. That said, there seems to be some sort of TouchBar integration[1]. It doesn't currently store
276.
by pfg 9y ago
Malware running on your computer is a game-over scenario even with hardware tokens. The main difference here is that you'll need to revoke the device key after a compromise. Password reuse and phishing are probably the most common thre
277.
by pfg 9y ago
> But hopefully someone else can comment on the security improvements of Soft U2F or if its more just building a standard rather than people having to rely on Authy or such. The main difference is that U2F is phishing-resistant because i
278.
by pfg 9y ago
> Can someone explain me the technical details as to how the mirroring of the website didn't raise any suspicion from the customer or buyer side ? I don't know any of the specifics in this case, but generally speaking, that wou
279.
by pfg 9y ago
> If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates of those two vendors, then can't I have a reasonable expectation that th
280.
by pfg 9y ago
I'd expect their S3 data transfer pricing to be closer to the assumed $0.02 CDN price. The price available to the public goes down to $0.05 once you hit 200 TB, and AWS is known to give significant discounts to large clients. The stora
281.
by pfg 9y ago
> I'm sure SC serves up a lot of content per day, but how do you think they will react by suddenly having someone download all of their 900 TB or whatever it is in one day? How much will Archiveteam be contributing to SC's down
282.
by pfg 9y ago
I don't think cloud storage is all that uncommon. Even before 1Password introduced subscriptions, they had sync options for things like Dropbox, and those were pretty popular in my experience. I imagine most users would want some sort
283.
by pfg 9y ago
Let's Encrypt has supported SAN certificates with up to 100 hostnames ever since they launched.
284.
by pfg 9y ago
> [...] that also redirects requests for ".well-known" which means renewal requests don't work What issue did you run into with this? Let's Encrypt follows redirects both to HTTP and HTTPS and accepts practically any
285.
by pfg 9y ago
I don't recall anything like that having happened before, even in the DigiNotar case, where the CA was thoroughly compromised. The keys must be kept in HSMs, so even with a fully compromised issuance system, the keys themselves are typ
286.
by pfg 9y ago
It does. "service nginx reload" (and similar commands, like systemctl reload nginx in systemd territory) sends SIGHUP to the nginx master process on all distributions I'm aware of, and that will cause the certificate and key
287.
by pfg 9y ago
It's not about the CA, it's about the level of validation your chose. All major CAs offer all three levels of validation - DV, OV, EV. DV doesn't involve any verification of personal/company details, no matter the CA.
288.
by pfg 9y ago
You can use "service nginx reload" for a graceful reload with zero downtime.
289.
by pfg 9y ago
Wildcard issuance and validation hasn't been implemented yet, but I see no reason why this shouldn't be possible once the feature is rolled out. My best guess is that you'll be able to mix wildcards and FQDNs to your liking,
290.
by pfg 9y ago
"paypal.com in the name" is a bit too ambiguous. You can register a subdomain like "paypal.com.example.com" and acquire a certificate for that, that's correct. There have been no mis-issuances under the actual domai
291.
by pfg 9y ago
In addition to what the other replies have already said: Domain Validated certificates have been a thing for years before Let's Encrypt entered the market. Most sites have used them and all mainstream CAs have automated the validation
292.
by pfg 9y ago
I don't think it's fair to say the operational overhead would be next to none. As it stands right now, most services that use per-user subdomains get wildcard certificates. Let's assume that wouldn't be an option for a s
293.
by pfg 9y ago
This is definitely true, and single-domain or SAN certificates should continue to be the first option administrators consider when deploying TLS. Wildcards make sense for things where the number of subdomains is unmanageable and where each
294.
by pfg 9y ago
Each FQDN is treated separately, so generally speaking, if you can demonstrate control for a FQDN under an ICANN TLD, you can obtain a certificate. Something you have to keep in mind are rate limits. Unless the (parent) domain owner has reg
295.
by pfg 9y ago
It's not going to do much for targeted attacks, but there are definitely ways to limit the damage for large-scale ransomware attacks. As it is right now, ransomware doesn't even need to bother with privilege escalation because fil
296.
by pfg 9y ago
If your CM is testing that the expiration date of the certificate that is actually used by a TLS server is correct, through whatever means, for example after each renewal operation, and if you also have some way to verify that the renewal o
297.
by pfg 9y ago
Again, you're assuming whatever automation you built is bug-free. Practice shows that sufficiently-complex software is never bug-free, no matter how many tests you wrote. Checking the expiration date on a certificate is easy, so why no
298.
by pfg 9y ago
Not monitoring something you rely on - like the expiration date of your certificate - would be the problem. Assuming that the entire process is bug-free sounds like a bit of a gamble.
299.
by pfg 9y ago
Let's Encrypt's renewal notifications don't cover cases where a new certificate was issued, but for some reason isn't being used by a server, perhaps because the ACME client ran into a problem, or because the server wasn
300.
by pfg 9y ago
This is due to the CA/B Forum Baseline Requirements stating that domain validation via DNS records (and pretty much all other methods) has to use either a random value or a single-use request token. There's a neat trick with CNAME

More ›