pfg

68 ms·

541.
by pfg 10y ago
It's still possible to remove CA certificates from the trust store on Android Nougat. It's also possible to use custom CAs for apps that explicitly opt into trusting custom CAs.
542.
by pfg 10y ago
The majority of cloud-based password managers perform encryption client-side. A server hack would leave the attacker with random garbage. Short of brute-forcing your master password, they're not likely to get anything. The only real co
543.
by pfg 10y ago
There's really not much of a difference between syncing via Dropbox (or similar products) and cloud services with the following characteristics: - Client-side encryption, meaning the service has no way to obtain your cleartext password
544.
by pfg 10y ago
While Chrome technically does not have the kind of root program that other OS or browser vendors run, they have the ability to revoke trust for specific roots, plus other things, like enforcing CT for specific CAs. Given that there's a
545.
by pfg 10y ago
Chrome is experimenting with something called Expect-CT[1], which allows site operators to indicate that only certificates with valid SCTs should be trusted. The implementation is quite similar to HSTS. It's report-only for now, but wi
546.
by pfg 10y ago
This came up on the Mozilla mailing list and the most likely explanation is that they're sharing some infrastructure, i.e. one CA is hosting the other[1]. This is apparently quite common in the industry. I don't think the Baseline
547.
by pfg 10y ago
> It'd be nice if you could flag your domain as being only acceptable from a CA of your choosing. HPKP pretty much solves this, and is already being used by a large number of high-value targets. DNS Certification Authority Authoriza
548.
by pfg 10y ago
They're cross-signed by StartCom, which is trusted by MacOS.
549.
by pfg 10y ago
The problem with this approach is that a CA that's been given the death penalty has little to lose, so they might just start backdating certificates. In fact, backdating SHA-1 certificates is one of the incidents they've now repor
550.
by pfg 10y ago
Such a system would require either centralized trust anchors, massive preload lists, or be trust-on-first-use. In other words, you're just reinventing variants (and combinations) of DANE or HPKP.
551.
by pfg 10y ago
There are thousands of accredited registrars out there[1], how is that going to improve anything ? I don't even want to get into the fact that the majority of them are not ones that I would call infosec companies. [1]: https:/
552.
by pfg 10y ago
That's exactly why the solution is neither the current CA system nor the CA-per-TLD (or TLD-as-CA) model, but rather one with full transparency with regards to issuance and wide adoption of key pinning.
553.
by pfg 10y ago
The line between desktop and web apps is becoming more and more blurred these days, so this seems like an inconsequential argument.
554.
Incidents involving the CA WoSign(groups.google.com)
4 points by pfg 10y ago|0 comments
555.
by pfg 10y ago
There's a IETF WG working on this[1]. It's been a while since I checked on the progress, so this might not be up-to-date, but it was DNS-based, with a way to export to a static file like the PSL (I'd assume in order to avoid
556.
by pfg 10y ago
You would not be able to increase any of the relevant rate limit counters without at least controlling a (sub)domain belonging to your competitor, or being able to send requests from the IP address your competitor is using to request certif
557.
by pfg 10y ago
If Namecheap sends a specific HTTP Status Code or a header like Retry-After when it performs rate limiting, this could probably be fixed in the lego DNS provider code for Namecheap. Do you happen to have any logs from when this happens? (No
558.
by pfg 10y ago
You can use the --test-cert or --dry-run flags for this purpose. The former just makes the client use the staging server (which has higher rate limits), while the latter uses the staging server to simulate renewal, stopping short of actuall
559.
by pfg 10y ago
Adding a subdomain would increase the "Certificates per Registered Domain" counter by one, just like removing a subdomain would. There's no difference.
560.
by pfg 10y ago
My comment regarding revocation was to clarify that unless you're currently revoking each of these certificates after removing a subdomain, there's probably no reason why you should remove the subdomain right away (instead of with
561.
by pfg 10y ago
A couple of points: 1. There is no way to remove a domain from an existing certificate. Changing a certificate in any way always results in a new issuance. That's just how certificates work, nothing specific to Let's Encrypt. Cert
562.
by pfg 10y ago
I don't have any first-hand knowledge, sorry. (Not affiliated with ISRG.) Based on some public posts, I believe Let's Encrypt is using Gemalto HSMs, though I'm not sure which model or how many of them.
563.
by pfg 10y ago
My point was that it incentivizes developers of server software to remove the "trouble" from your equation. Of course (and to put it bluntly), you're free continue to put your users at risk, just like browser vendors are free
564.
by pfg 10y ago
The signing capacity of the HSM (or possibly HSMs, I'm not sure) holding the intermediate certificate is limited. These devices are quite expensive, so it's not that easy to scale this resource. In comparison to that, a pending
565.
by pfg 10y ago
What certificate issuance through a public API (ACME) allows you to do is have your server software automatically request and deploy a certificate for your hostnames (like Caddy[1]). That's probably the simplest process you can get in
566.
by pfg 10y ago
The process is described here[1]. It needs to be performed by the domain owner. [1]: https://publicsuffix.org/submit/
567.
by pfg 10y ago
Dynamic DNS providers that are on the Public Suffix List are essentially treated like TLDs in terms of rate limiting, meaning each client subdomain has a separate counter. They should probably be on the PSL anyway; browsers rely on it for c
568.
by pfg 10y ago
You're missing the point here. helloworld.letsencrypt.org was used as the Test URL in the root inclusion ticket[1]. The certificate was renewed multiple times[2], but the expired certificate had to be restored at one point in order to
569.
by pfg 10y ago
XP is supported. There was an issue due to some schannel bug in XP choking on the issuer certificate, but that was fixed earlier this year.
570.
by pfg 10y ago
Typical (WAN) network conditions are not all that different from a small random timeout, and these kind of attacks still work. Adding random noise just means you'll need more samples, but statistics are going to win eventually. I guess

More ›