pfg

47 ms·

391.
by pfg 10y ago
That's moving the goalposts. A backdoor in the app itself is a whole different matter - both legally (give us these records/change these records in your database vs. build software according to our spec and ship it to your custome
392.
by pfg 10y ago
This can be detected if the sender and the recipient attempt to verify their keys out of band (i.e. in person or through some other trusted communication channel). WhatsApp allows you to do that.
393.
by pfg 10y ago
Yes, but this thread starts with "Even if they changed this specific design decision/vulnerability, it seems like there's a big gaping hole (or I'm missing something)." I don't see how WhatsApp would be vulnera
394.
by pfg 10y ago
Sorry, I was thinking under the premise of a hypothetical version of WhatsApp where this behaviour was changed, since that's what OP was referring to. In that scenario, I don't see where the gaping hole is.
395.
by pfg 10y ago
That's why WhatsApp allows you to verify your recipient's key out of band. The scenario you describe would cause the identity key to change and trigger a notification if one of the potential clients has that option enabled. There&
396.
by pfg 10y ago
WhatsApp has the ability to change the identity key associated with a user. That's the key they give anyone who wishes to send a message to that user. This is necessary in case the device is lost, wiped or replaced. Changing the identi
397.
by pfg 10y ago
> This is version 1.0 of our scorecard; it is out of date, and is preserved here for purely historical reasons.
398.
by pfg 10y ago
Not all that much has changed. SSL Pulse[1] shows that use of OCSP Stapling went up about 3% in the past 12 months, currently putting it at 25% of observed sites. OCSP Must-Staple is now available in Firefox and can be added as an extension
399.
by pfg 10y ago
Interesting tidbit: The CA/B Forum passed a change to the Baseline Requirements attempting to standardize the methods of domain ownership validation back in August of last year[1]. Prior to that, it was essentially up to the CAs to com
400.
by pfg 10y ago
The way the http-01 challenge in ACME mitigates this is by not putting the whole token they'll look for in the request. Basically, they request example.com/.well-known/acme-challenge/<random_token>, and the request
401.
by pfg 10y ago
I assume by "multiple SANs", you're referring to subdomains under the same registered domain? In that case, you can use the rate limit adjustment form or register your domain as a public suffix if that's more appropriate
402.
by pfg 10y ago
> Why do all the other CAs cost so much and take so long when the actual cert is generated in seconds? I guess "so much" should be put in perspective: Domain Validation certificates, like the ones Let's Encrypt issue, are
403.
by pfg 10y ago
This sounds more like a design decision by that blogging platform rather than something that's caused by Let's Encrypt. Excluding maintenance windows or any other unplanned downtime or performance issues (which happen relatively r
404.
by pfg 10y ago
Presumably, you would want to have monitoring in place for certificate expiration either way, so this expense is not really specific to short-lived certificates.
405.
by pfg 10y ago
I think it's fairly likely we'll see a number of CAs adding ACME support at some point. Judging by participation on the ACME mailing list, there seems to be interest from (at the very least) DigiCert, Entrust and cough StartSSL.
406.
by pfg 10y ago
> Is there a list of major B2B and eCommerce sites using LE for their primary customer facing sites? This would be useful if our customers brought it up. W3Techs[1] is generally a good source for this kind of information. Themeforest see
407.
by pfg 10y ago
> But I'm not necessarily thinking of a standalone "free certificate company" but maybe more of a "bonus" to some other product or service. This is what I expect we'll see more of, rather than a second (and
408.
by pfg 10y ago
I agree with the eggs/basket argument, though I suppose there's an argument to be made about a number of CAs being essentially too big to fail already, so what's one more? Regarding client certificates: There aren't real
409.
by pfg 10y ago
> But what happens when you lose that security token? It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys that your users can print out and keep in a safe place. Or have mo
410.
by pfg 10y ago
A phishing page can simply imitate the 2FA step in the login process and ask for the OTP to be entered, and then use it for its own login attempt. With U2F, the site basically authenticates itself as well, so a third-party phishing page wou
411.
by pfg 10y ago
Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you can use for things like SSH authentication.
412.
by pfg 10y ago
Chromebooks have generally been okay when it comes to bloatware (OEMs seemingly aren't allowed to do more than pre-install easily-removable (Chrome) extensions, and even that doesn't seem to be very common). Maybe that's goin
413.
by pfg 10y ago
Encryption does not prevent you from doing that, just everyone else. Of course, with non-free software and walled gardens, that might involve some amount of reverse engineering, injecting a CA certificate in a trust store so you can run a
414.
by pfg 10y ago
For their web client, the encryption is really only useful as long as you can guarantee that the JavaScript code has not been tampered with. Once a court orders them to hand over the private key of their TLS certificates (as has happened in
415.
by pfg 10y ago
AES512 isn't a thing. AES uses 128, 192 or 256-bit keys.
416.
by pfg 10y ago
> I guess a NSL might compel OWS to push a binary specifically for a targetted user. To my (admittedly fairly limited) knowledge, that's something the courts have yet to rule on. They can definitely ask to you give them any data the
417.
by pfg 10y ago
I'm holding out hope that they'll add support for U2F/UAF via TouchID once W3C is done with the Web Authentication API[1]. [1]: https://www.w3.org/TR/webauthn/
418.
Using centralised management with Let's Encrypt(crc.id.au)
3 points by pfg 10y ago|0 comments
419.
by pfg 10y ago
I don't like the fact that a significant percentage of page views on the Internet can be intercepted by a single organization either, but I think it's a bit weird to be concerned about privacy while arguing they should pivot to mo
420.
by pfg 10y ago
These HPKP instructions are rather dangerous (as in: more dangerous than they have to be). The hash is for the ISRG root certificate, which is not widely trusted yet. While an ISRG-signed intermediate certificate is available, all clients c

More ›