pfg

70 ms·

721.
by pfg 10y ago
It's not perfect, but E2E crypto does make it significantly harder to get to the plaintext. A backdoor will always leave some kind of paper trail (if you know what to look for), whereas intercepting the plaintext on the server cannot b
722.
by pfg 10y ago
This was very interesting and insightful to read, thanks!
723.
by pfg 10y ago
I think the article is referring to the fact that out-of-band key verification is optional and isn't something that most users will perform. If you're doing out-of-band key verification with all your contacts, and have enabled t
724.
by pfg 10y ago
I don't think anyone has implied that E2E-crypto without out-of-band key verification is bulletproof. Both WhatsApp and Signal allow you to do that.
725.
by pfg 10y ago
> They can't compel you to DO something, as demonstrated by FBI v Apple recently. In case anyone who's not familiar with the Apple case is reading this: The government didn't actually wait for the court to rule that they c
726.
by pfg 10y ago
Interestingly, there's also this bit on their homepage[1]: > In order for your subpoena / order to be processed, it must be sent to my lawyer. Do not send subpoenas to vc@cock.li or abuse@cock.li. Instead, E-mail or call me to
727.
by pfg 10y ago
Can you provide a citation for that? It seems to be like it would be impossible to show proof that such an email was received[1], which I imagine is necessary to declare the subpoena served in a court of law. We do have some other means for
728.
by pfg 10y ago
I don't think sending an email would legally count as a served subpoena, at least not unless you somehow (at the very least, but I doubt that's sufficient) indicated that you're fine with that? I'm not familiar with how
729.
by pfg 10y ago
re. 1) and 3): CloudFlare is not blocking exit nodes because of volumetric DDoS attacks. That's not really viable over Tor anyway. It's mostly to block comment spam, crawlers and vulnerability scans (e.g. SQLi), which is unfortuna
730.
by pfg 10y ago
You don't need to buy certificates. There are at least four CAs offering free certificates, with at least two (Let's Encrypt and StartSSL) offering API-based issuance. Getting a publicly-trusted certificate from Let's Encrypt
731.
by pfg 10y ago
It's not wrong, given that it's a reply to this statement: "... without having to setup TLS on your origin server." Strict mode is optional. It's certainly possible (and highly recommended!) to use transport encrypt
732.
by pfg 10y ago
It's quite common in corporate networks. Locally installed CA certificates (i.e. anything that's not in the original root CA list) are exempt from HPKP rules for this particular reason.
733.
by pfg 10y ago
I'm aware of corporate MitM proxies, but it's less common to run into these kinds of issues if you simply use wss://, because a) they're not quite as common as your typical ancient HTTP caching proxy and b) there&#x
734.
by pfg 10y ago
Usually not much of a problem behind HTTPS (or wss:// in this case).
735.
Alpha Payroll fires employee victimized by W-2 Phishing scam(csoonline.com)
2 points by pfg 10y ago|0 comments
736.
by pfg 10y ago
Not sure if I'm missing something, but does the padding oracle really have anything to do with the code being written in C?
737.
by pfg 10y ago
tl;dr: site used to track public password breaches allowed users to get a list of 866M credentials because of a simple parameter tampering vulnerability.
738.
How the Pwnedlist Got Pwned(krebsonsecurity.com)
30 points by pfg 10y ago|5 comments
739.
by pfg 10y ago
That would avoid transmitting the key to the server, but in the scenario I mentioned, it would still be accessible to the backdoor via window.location.hash.
740.
by pfg 10y ago
I think something like the self-hosted version (file:///) of this is getting close to something I'd consider safe enough. The backdoor problem from my previous post obviously isn't exclusive to web apps - a large ch
741.
by pfg 10y ago
I'd argue it's not significantly better than any existing product that uses transport-level security without E2E crypto. Both systems are likely to be broken if there's a server-side breach, though I'd admit there's
742.
by pfg 10y ago
> Adopt Mega's model where they store the private key, but encrypt it with the user's password and only the browser has the decrypted copy. Unless you're going to audit every single line of code Mega uses on their site eve
743.
by pfg 11y ago
Were you thinking of "vocal minority"? Seems to fit here.
744.
by pfg 11y ago
IIRC it's the "Security Notices" list from https://about.gitlab.com/contact/
745.
by pfg 11y ago
From an email they sent out two days ago: The following versions are affected: 8.7.0 8.6.0 through 8.6.7 8.5.0 through 8.5.11 8.4.0 through 8.4.9 8.3.0 through 8.3.8 8.2.0 through 8.2.4 Not sure why this
746.
How Coinbase Builds Secure Infrastructure to Store Bitcoin in the Cloud(medium.com)
14 points by pfg 11y ago|0 comments
747.
Flaw allowed anyone to modify and take control over any .as domain(isecguy.wordpress.com)
3 points by pfg 11y ago|0 comments
748.
by pfg 11y ago
The comments shed some light on what exactly caused this[1]: > Yes, as part of our investigation we did reach out and it sounds like it was related to a route optimizer. [1]: http://www.bgpmon.net/large-hijack-affects-rea
749.
Let's Encrypt Reaches 2M Certificates(eff.org)
32 points by pfg 11y ago|2 comments
750.
by pfg 11y ago
I'm guessing this is part of the telemetry Chrome gathers. IIRC when you first install Chrome, there's an opt-in (or opt-out) where it asks the user whether sending usage information to Google is okay. Firefox does something simil

More ›