pfg

67 ms·

571.
by pfg 10y ago
Certificates issued by Let's Encrypt are cross-signed by IdenTrust and are trusted by all major browsers[1]. This is just about their own root certificate. Being cross-signed by an existing, trusted CA is a common practice for new CAs,
572.
by pfg 10y ago
The most recent Java update added the DST (IdenTrust) root certificate. Of course it's going to take a while until that version is widely deployed, but this gives vendors the option to tell API consumers to just update Java (as opposed
573.
by pfg 10y ago
The Resource Timing APIs are typically used for performance monitoring. I expect well-behaved sites would degrade gracefully if those APIs aren't available (because they're not universally available anyway - Safari, for example, d
574.
by pfg 10y ago
The attack determines the size based on the timing information returned by the Resource Timing APIs and the compression side-channel. This is described in section 2.2 of the paper.
575.
by pfg 10y ago
The thing is: this attack doesn't even use CORS. It just sends a GET request to an URL and looks at the timing, which can be done using the fetch/Resource Timing APIs. Here's a JSFiddle to play around with this[1], based on t
576.
by pfg 10y ago
Any chance this is a tracking issue? You might be losing referer information because of the 301, see [1]. [1]: http://piwik.org/faq/troubleshooting/#faq_51
577.
by pfg 10y ago
Hopefully by that time we've reached the point where we can deprecate HTTP without TLS and show appropriate warnings in browsers.
578.
by pfg 10y ago
You think users cannot be trained to recognize a green padlock, but they'll know to look for "secure://"? That seems a bit ... far-fetched.
579.
Obtaining Wildcard SSL Certificates from Comodo via Dangling Markup Injection(thehackerblog.com)
258 points by pfg 10y ago|58 comments
580.
by pfg 10y ago
Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know , since the whole point
581.
by pfg 10y ago
> Well, such use cases are internal email via IMAP with STARTSSL, they are browser traffic with default browsers (those don't allow custom CAs either, you'll likely have to compile a custom build yourself), etc. Do you have a s
582.
by pfg 10y ago
Just keep using the same key for renewals, or pin to something other than the end-entity certificate (like Let's Encrypt's intermediate certificate, or IdenTrust's root, plus some backup pins).
583.
by pfg 10y ago
Certbot supports Ubuntu 12.04+ (14.04+ for the apache plugin), CentOS/RHEL 6+, and Debian 7+. With the exception of CentOS/RHEL 5 (which was released in 2007!), all releases of those distributions that still receive security updat
584.
by pfg 10y ago
AFAIK that is only relevant for apps. It is still possible to import CAs for browser traffic, for example, and it's still possible to opt-in to trusting custom CAs as an app. So this is only really a problem for non-browser apps that a
585.
by pfg 10y ago
lego seems to have a plugin for Gandi's DNS API[1]. Let's Encrypt always sends DNS queries to the domain's authoritative DNS server and doesn't cache any results, so as soon as your authoritative DNS server has the recor
586.
by pfg 10y ago
Oh, I thought you were referring to something on Let's Encrypt's end. For "real" internal names, internal CAs sound like the best option, and would work just fine with what browsers call "powerful features." Fo
587.
by pfg 10y ago
I'm not sure what your last sentence is referring to. Who or what is requiring https for internal things?
588.
by pfg 10y ago
Short certificate lifetimes should have no implications on rate limiting, as renewals do not count against the rate limits, so whether you need to renew your certificate every 90 days or every year won't matter.
589.
by pfg 10y ago
Domains don't have to be externally accessible, they just can't be internal names (i.e. "made-up" domain names that you do not actually own), which is true for all public CAs. The DNS-01 challenge type does not require t
590.
by pfg 10y ago
Take a look at lego, it appears to support Vultr's DNS API[1] (and many others). [1]: https://github.com/xenolf/lego/tree/master/providers/dns/vul...
591.
by pfg 10y ago
That's not up to Let's Encrypt, Baseline Requirements created by the CA/B Forum only permit EV for *.onion.
592.
by pfg 10y ago
I think that's pretty much the exact definition of "available" in this context. If it just exists in a RFC somewhere, I wouldn't call it "available".
593.
European Commission to Audit Apache HTTP Server and Keepass(joinup.ec.europa.eu)
1 points by pfg 10y ago|0 comments
594.
by pfg 10y ago
If your question is regarding the precedence of the Proxy header vs. an environment variable, I'm not sure which of the two would win, but even if it's the latter, anyone who doesn't set it (which is probably the majority) wo
595.
by pfg 10y ago
Their free plan uses SAN certificates too. The difference is that they do "one (shared) SAN certificate per IP" for paid plans, as opposed to "multiple (shared) SAN certificates per IP" on the free plan, which requires S
596.
by pfg 10y ago
There's no such thing as a SNI certificate. SNI is a TLS extension allowing clients to send the hostname as part of the Client Hello, which allows the server to pick the right certificate for the hostname being requested. Without SNI,
597.
by pfg 10y ago
You're probably missing the "That strategy does negatively effect people on the internet who register for WhatsApp with Saudi VoIP numbers when they're in France" bit. It's a reasonable trade-off in light of the com
598.
by pfg 10y ago
Only if your definition of "technical person" is "contributes code to Tor".
599.
by pfg 10y ago
So The Pirate Bay is not using SSL for backend traffic. Just ... wow. sigh
600.
by pfg 10y ago
It makes a lot of sense for mobile messaging apps, though, and that's what both Signal and WhatsApp are. Phone number == username is an implementation detail of Signal (the app) and WhatsApp and not something the protocol dictates. Oth

More ›