pfg

94 ms·

841.
by pfg 11y ago
There are laws against breaking into people's homes, and yet the police still does it daily. IANAL, but I assume a warrant would apply to this case just the same.
842.
by pfg 11y ago
IIRC the appeals court ruled that the "'structure, sequence and organization' of an API was copyrightable". So even if they hadn't copied a small number of classes¹, they'd still be liable if that decision hold
843.
by pfg 11y ago
> 2) Apple started to emphasize their environmental friendliness (including energy efficiency) in manufacturing process and product raw materials and has been advancing their game each year[2]. So a once more toxic product made 5 years a
844.
by pfg 11y ago
There's a huge difference between running outdated software with serious security problems and using older hardware that might be perfectly capable of running a modern OS and modern web browsers. I own both a 7 year old desktop PC and
845.
by pfg 11y ago
I'm not aware of any RFCs on the matter either. Some DNS servers do this to protect against DNS rebinding attacks, though.
846.
by pfg 11y ago
> P.S. In the unlikely event that someone involved is reading this, PLEASE make this a DNS attribute that is set on the top-level domain instead, in a TXT record perhaps. It's silly that we have to have a globally coordinated and di
847.
by pfg 11y ago
You can get up to 100 SANs on one certificate, which will only increase your rate limit counter by one. Works nicely if you have a (mostly) fixed list of subdomains, but becomes hard or impossible to manage if subdomains are dynamic.
848.
by pfg 11y ago
Not sure about that, based on this[1]. The turnaround time for this is a bit too fast for it to be just a reaction to that incident, I think. (Not saying that it's a coincidence either.) [1]: https://www.startssl.com/Ne
849.
by pfg 11y ago
Sure, it's a vulnerability in the sense that they didn't want to allow WHOIS-based verification from their web frontend (for whatever reason. Maybe it wasn't even a conscious decision and they just forgot to include it during
850.
by pfg 11y ago
I think the end-game for CT is that all certificates will have to be submitted to log servers, so this is going to happen anyway.
851.
by pfg 11y ago
It could be that, or the researcher really didn't think to try it with an address that's completely unrelated to the domain. Personally, I find it hard to believe that an audited CA has a system where the web frontend can make a d
852.
by pfg 11y ago
It's worth pointing out that StartCom claims the verification email address in the article in question was only accepted because it matched the WHOIS record of said domain[1], which is permitted according to CA/B Baseline Requirem
853.
StartCom will log all issued SSL certificates to public CT log servers(startssl.com)
74 points by pfg 11y ago|53 comments
854.
by pfg 11y ago
It's not technically necessary for a TLS web server to have unfettered access to the private key. The web server could offload the signing operations to a separate server under the control of the attacker. The web server only has acces
855.
by pfg 11y ago
VPS plans with 2GB RAM are available at around the same price point as one GitLab EE license. GitLab has a lot of dependencies, many components and is written in a language and using a framework that's not so much optimized for perform
856.
by pfg 11y ago
If the private key is compromised or the HPKP header is changed through some other vulnerability in your site, the attacker could still satisfy the existing pin header. The attack for clients with cached pins would be a bit more involved an
857.
by pfg 11y ago
GitLab CE is Open Source too and should at least be feature-equivalent to gogs. (gogs is still a great project!)
858.
by pfg 11y ago
That's an interesting and scary attack I hadn't thought about before. HPKP headers should become part of security monitoring strategies to reduce the impact of such an attack, independent of whether a site actually uses HPKP or no
859.
by pfg 11y ago
Actually, Signal uses bloom filters to do "offline", private contact discovery[1]. That's why their contact discovery is rather bandwidth-intensive, as @praseodym mentioned. [1]: https://whispersystems.org/blo
860.
by pfg 11y ago
The article mentions the device might be exploiting CVE-2014-4451, which was fixed in iOS 8.1.1.
861.
by pfg 11y ago
That seems appropriate. Google forced Symantec to do the same thing because of a number of misissued certificates[1]. [1]: https://security.googleblog.com/2015/10/sustaining-digital-c...
862.
by pfg 11y ago
I think it would only work with Apple's help (via court order or a breach) because Apple implemented certificate pinning as of iOS 9.0 according to the article.
863.
by pfg 11y ago
Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs. ¹ As long as you're monitoring CT log servers for anything involving domains you own.
864.
by pfg 11y ago
It's certainly easier for automation. I think the security implications are mostly the same - you're vulnerable to DNS spoofing and BGP hijacking either way. With email validation, a misconfigured or breached email server is enoug
865.
by pfg 11y ago
Your solution is still vulnerable in cases where someone's able to control postmasterfoobar@example.com. Admittedly, that's a bit far-fetched, but the correct solution would be to have an enumeration of allowed emails and only acc
866.
by pfg 11y ago
It has been fixed according to the article: > In 9 March, 2016 During my research I was able to replicate the attack and issue valid certificates without verifying the ownership of the website which I will explain later in my post, the v
867.
by pfg 11y ago
If someone has fraudulently issued a certificate for a domain you own using this (or any other) vulnerability, you're not actually a client of theirs and I don't see how they could force you to pay for revocation. Issuing such a c
868.
by pfg 11y ago
> This method is rarely used, instead for the domain validation most certificate authorities ask the domain owner to place a certain file in their websites. This statement strikes me as odd. Email-based validation is the most common vali
869.
by pfg 11y ago
It's my understanding that iMessage encrypts messages using the public keys of all devices the recipient owns. The server would only store that ciphertext, which is useless without the private key only available to the recipient. Is th
870.
by pfg 11y ago
The FBI is asking for firmware that disables its anti-brute-force delays and auto-wipe feature. The estimate Apple gave is for creating that firmware and signing it with their key. They're not breaking the crypto, but merely making an

More ›