pfg

83 ms·

781.
by pfg 11y ago
The general consensus is that certificate revocation is essentially broken right now. CRL updates can be blocked (some browsers don't even check) and OCSP defaults to soft-fail in most scenarios, so that's not going to do much aga
782.
Password Authentication Bypass Fixed in GitLab 8.6.5(about.gitlab.com)
2 points by pfg 11y ago|0 comments
783.
by pfg 11y ago
The existence of this feature has no implications on the question of whether or not there's a backdoor in the client. The current implementation requires approval by the client . A hypothetical backdoor could be anywhere, and you woul
784.
by pfg 11y ago
> It used to be very simple to add a full-page caching layer in front of your unencrypted application. TLS completely destroys this. You can no longer simply plop a proxy cache in front of your application. I wouldn't say it's
785.
by pfg 11y ago
The rate limits have been changed to 20 certificates per domain per week recently. The registrations/IP rate limits aren't really a problem - WordPress could, in theory, run their entire Let's Encrypt infrastructure using one
786.
by pfg 11y ago
The problem is that you'll still need some kind of unique "domain space", i.e. you can't have just <ip>.vendor.direct (or whatever the TLD would be), because then multiple users could get a signed certificate for t
787.
by pfg 11y ago
This is about custom domains, not subdomains of wordpress.com (they're using a wildcard cert for that, and have been for years). Rate limits aren't much of an issue in that scenario unless someone has more than 20 separate subdoma
788.
by pfg 11y ago
No, this solution would work with LAN devices and internal IPs as well, although there would be some extra requirements if it needs to work without internet connectivity¹. Some things to keep in mind: * Publicly trusted CAs are not allowed
789.
by pfg 11y ago
I'm not aware of anything like that existing, but this would be a nice side-project. The solution I'm thinking of - pretty much the same thing Plex is doing, but more generalized - would allow clients to register a DNS label under
790.
by pfg 11y ago
Internet Explorer doesn't support SNI on Windows XP, correct. Let's Encrypt doesn't force you to use SNI, though. SNI is not something you "stick" on a certificate - it's a TLS extension which you don't h
791.
by pfg 11y ago
Note that this is about custom domains hosted on Wordpress.com's infrastructure. Blogs that were hosted as subdomains of wordpress.com have been using SSL since 2014 according to the original announcement. Let's Encrypt allowed
792.
by pfg 11y ago
WeChat has over 650 million users, mostly in China. Quoting Wikipedia: "WeChat allows people to add friends by a variety of methods, including searching by username or phone number, adding from phone or email contacts [...]"
793.
by pfg 11y ago
I'm not sure if WordPress is actually doing this, but they might be using something like camo[1] to transparently rewrite any http:// URLs to an image proxy running on SSL. This gets harder to implement correctly depending
794.
by pfg 11y ago
Original announcement: https://en.blog.wordpress.com/2016/04/08/https-everywhere-en...
795.
by pfg 11y ago
> Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book. No, not really
796.
by pfg 11y ago
> But I do submit as evidence of my hypothesis that several social networks were successful on mobile without it (e.g. Twitter, Instagram and Facebook). All of those examples use phone numbers as (at the very least) a secondary contact d
797.
by pfg 11y ago
> 1) New social networks tend to replace old social networks: I'm not forced to use it but, for example, I can't go back to XMPP because others don't use it anymore. Meaning the option is not to communicate. Right, but thi
798.
by pfg 11y ago
WhatsApp Web communicates directly with your phone. You have to authorize the session from within the app. Communication between your browser and the app is end-to-end encrypted.
799.
by pfg 11y ago
WhatsApp is a mobile messaging app. It's a drop-in replacement for SMS. There would be absolutely no reason for anyone to use WhatsApp if they were just another chat app with their own contact discovery that's not based on phone
800.
by pfg 11y ago
There's really not much of a difference, except that WhatsApp allows you to verify the fingerprint and will notify you if your chat partner's public key changes. WhatsApp doesn't force to you meet your contacts, and there&#x2
801.
by pfg 11y ago
WhatsApp allows you to (optionally) backup your chat history to iCloud or Google Drive. Moving to a new device involves restoring that backup. Your contacts will also have to re-verify your fingerprint. This, of course, is also a way for ad
802.
by pfg 11y ago
I think the actual implications wouldn't be too different in production. Those are the main scenarios where Binary Transparency might be of use: 1. An application developer's private key gets compromised (either through a breach
803.
by pfg 11y ago
It depends on your goals. If your goal is to tick a compliance box saying "no third-party has access to our private key" or "our private key never leaves our DC", then they have it figured out. If you want an additional
804.
by pfg 11y ago
if the client encryption is reliable It's not[1]. [1]: https://eprint.iacr.org/2015/1177.pdf
805.
by pfg 11y ago
"Secret Chat" uses Telegram's (flawed) E2E protocol, so the server would only see ciphertext. A "normal" chat is stored in plaintext. This is also why normal chats work in multi-device environments, but secret chats
806.
by pfg 11y ago
Manual authentication via QR (or comparing the digits) works on top of the server-side authentication. It does what iMessage does, but you also have the option to actually compare the fingerprints if you are so inclined.
807.
by pfg 11y ago
The client has access messages in clear text. A backdoor could easily deliver those messages to a third-party, yes. This is not something E2E protocols can protect you from. You'd have to audit every piece of firmware and software on y
808.
by pfg 11y ago
Obfuscation would be a better term here. They've made it hard to reverse-engineer, but certainly not impossible.
809.
by pfg 11y ago
> From that perspective, I'm still inclined to trust apple's iMessage a bit more especially after recent events. // edit: got my answer here: https://news.ycombinator.com/item?id=11432629 I'm cur
810.
by pfg 11y ago
Telegram doesn't do end-to-end crypto by default, and uses home-baked crypto which has many weaknesses[1]. I like it as a platform (for their Bot API, Channels and Groups), but I don't like their security mentality. [1]: https:&#

More ›