pfg

80 ms·

751.
by pfg 11y ago
You can actually set a passphrase that's used to encrypt all synchronized items, before they're being sent to Google[1]. [1]: https://support.google.com/chrome/answer/1181035?hl=en
752.
by pfg 11y ago
Slightly OT: I wish more projects with a rapid release cycle would adopt CalVer (calendar-based versioning, like Ubuntu). I find they're much easier to parse for humans, and the semantics are just fine for projects such as Chrome and F
753.
Operational Security of WhatsApp (on iOS)(medium.com)
2 points by pfg 11y ago|0 comments
754.
by pfg 11y ago
That's not correct - the site asks for a CSR, which doesn't include your private key. The private key (and ACME account key) doesn't leave your device.
755.
by pfg 11y ago
Yep, dns-01 went live in January. If your DNS server happens to support RFC 2136, take a look at lego[1] - some other provider-specific plugins for DNS are included as well. [1]: https://github.com/xenolf/lego
756.
by pfg 11y ago
If dns-01 is currently a blocker for you, and you're willing to run a HTTPd on each server, there might be another option: Redirect all challenge requests (i.e. requests to .well-known/acme-challenge) to a common verification serv
757.
by pfg 11y ago
Out of curiosity, do you know if they've changed how they distribute their keys? This seems like a perfect candidate for something like CloudFlare's Keyless SSL, but I'm not aware of any ircds having support for something lik
758.
by pfg 11y ago
Is there any evidence that IRC users are somehow more likely to accept self-signed SSL certificates? The IRC clients I'm familiar with rely on the OS trust store, just like most web browsers do. To me this seems like saying a webmail s
759.
by pfg 11y ago
Many ircds I'm familiar with include a "<user> is using a secure connection" message in their WHOIS response, so this is easily verifiable. Obviously, it's still not E2E-encrypted, so if you don't trust the ir
760.
by pfg 11y ago
How is that? Unless you're accepting self-signed certificates, that seems hard to pull off unless you're a state actor.
761.
by pfg 11y ago
That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like SHA-1 certificates), TLS security is about server configuration; certificates are
762.
by pfg 11y ago
I'm not sure I follow? What I was trying to say was that it's a good idea to have one key per DISTINCT($attack_surface), which includes anything from physical security to the software stack, in order to limit the damage during a c
763.
by pfg 11y ago
Sounds like you're looking for the darkstat package, which is available in pfSense.
764.
by pfg 11y ago
It seems you're misunderstanding what I meant with $RANDOM_CA_RESELLER. There are tons of random hosters who resell SSL certificates (sometimes as a white-label product), and many of them have terrible documentation. RapidSSL, one of
765.
by pfg 11y ago
Could you elaborate on how Cisco being a sponsor affects your trust in Let's Encrypt? It's in the nature of the CA system that it's only as strong as its weakest link, and there are dozens if not hundreds of CAs of questionab
766.
by pfg 11y ago
Take a look at any of the three bash clients listed here[1]. [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
767.
by pfg 11y ago
Out of curiosity, have you thought about registering neocities.org as a Public Suffix? Aside from bypassing the rate limits, neocities.org seems like it would belong on the list, given that you're (more or less) delegating control over
768.
by pfg 11y ago
They do! boulder[1], the server software behind Let's Encrypt, is open source. [1]: https://github.com/letsencrypt/boulder
769.
by pfg 11y ago
Given that the resource being limited here is signing operations performed by their HSM, this wouldn't really help much. (OCSP responses wouldn't have to be signed for quite as long, but still.) There's a staging server issui
770.
by pfg 11y ago
Having access to the internal network is a "game over" scenario for 95% of real-world networks. I'm not sure if anyone would even attempt to use something as elaborate as MitM in a crypto locker, when they could most likely j
771.
by pfg 11y ago
We've already established that this is a documentation issue worth fixing, but surely you're not suggesting a lack of IIS-specific documentation on the website is reason enough to keep using the beta-label? Have you ever had the p
772.
by pfg 11y ago
Let's Encrypt is, primarily, a CA. CAs don't "support" web servers or operating systems. They provide certificates, which are trusted by (most) clients. Traditional CAs leave the actual configuration of said certificates
773.
by pfg 11y ago
I'm not sure if, conceptually, the term "official client" is still appropriate after the project is moved to the EFF and the rename is done. It's basically a move to ensure a vibrant client ecosystem which encourages use
774.
by pfg 11y ago
Sure, the documentation isn't perfect yet. The client is being split from the CA in the near-future (as well as renamed), so this aspect of the documentation will need to be reworked anyway. That being said, I sincerely hope that anyon
775.
by pfg 11y ago
There are a number of Windows/IIS clients[1]. [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#window...
776.
by pfg 11y ago
Let's Encrypt is actually an implementation of the ACME (Automated Certificate Management Environment) specification, developed by the IETF[1]. The goal is to get other CAs to adopt the standard as well. In the meantime, other CAs are
777.
by pfg 11y ago
> That said, I'd still opt for a wildcard certificate for anything enterprisey. Many sites use wildcard certs because they're the simplest way of getting SSL for your entire domain. There is one huge problem with that, though:
778.
by pfg 11y ago
If your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual
779.
by pfg 11y ago
It's been changed to 20 per domain (and 5 per identical FQDN set, i.e. certificates that are exactly the same) recently.
780.
by pfg 11y ago
The API is essentially a paginated list of certificates. There's no "search by domain" or anything like that. Monitors are expected to continuously get the latest entries and check them according to their rules. COMODO has a

More ›