pfg

95 ms·

871.
by pfg 11y ago
Haven't run into any issues on a ThinkPad T420. There's a number of more recent ThinkPads on their Hardware Compatibility List[1] as well. [1]: https://www.qubes-os.org/hcl/
872.
by pfg 11y ago
According to this[1], that's a permanent decision. Given that both Google and Mozilla have discussed plans that would eventually mark http:// as unsafe in the UI, I don't think that decision is going to change. [1]: h
873.
by pfg 11y ago
DynDNS works fine. CA/B Baseline Requirements (which all trusted CAs have to follow) forbid issuance of certificates that include internal names. Whether you actually bought the domain or just have control over a subdomain (as with Dyn
874.
by pfg 11y ago
All major browser vendors decided not to implement opportunistic encryption in HTTP/2.
875.
by pfg 11y ago
Let's Encrypt renews certificates after 60 days by default, giving you a 30-day grace period for outages, etc. Use a daily cronjob and monitor your certificates. Setup alerts if your certificates are closer than, say, 25 days to expira
876.
by pfg 11y ago
I'm assuming we're talking about CAs other than Let's Encrypt? In which case this is expected; not many CAs currently submit all their certificates to CT logs. It's only mandatory for EV certificates. The biggest source
877.
by pfg 11y ago
Yes, it's very common in enterprise scenarios and with regular SMBs.
878.
by pfg 11y ago
Yes, but JavaScript is still enabled by default[1]. [1]: https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
879.
by pfg 11y ago
There's a fairly popular PPA which is currently on 2.90[1]. However, it seems like only OS X binaries included malware (... hopefully). [1]: https://launchpad.net/~transmissionbt/+archive/ubuntu/ppa
880.
by pfg 11y ago
NTP.
881.
by pfg 11y ago
> You could imagine a privilege escalation that gives you access to the loopback interface but not enough to install a key-logger. That's a weird thing to say. If you manage to bypass file system access rules, there's any numbe
882.
by pfg 11y ago
I don't agree that installing a key logger (of which there are hundreds out there) and stealing the encrypted password files is in any way harder than logging lo0 and waiting for passwords to slowly trickle in while they're being
883.
by pfg 11y ago
You can't read loopback as a normal user. If you have root, you don't need to read unencrypted loopback traffic to get the passwords - just use a key logger.
884.
by pfg 11y ago
Someone with administrative access would have an almost unlimited number of ways of accessing passwords in any password manager. Key logging, memory dumps ... once your system is owned, you're SOL.
885.
by pfg 11y ago
Or, more specifically, disabling all SSLv2 ciphers didn't disable SSLv2 entirely. Disabling SSLv2 as a protocol worked.
886.
by pfg 11y ago
That seems to be the case only for IE 6, not 7 or 8[1] (which are available on XP). [1]: https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...
887.
by pfg 11y ago
> Everyone who had sslv2 enabled at any point in the past must get a new SSL certificate right away. Right? No, unlike Heartbleed, the key isn't leaked directly. Revocation and generating a new key isn't necessary - just patch
888.
by pfg 11y ago
Unlike Heartbleed, the actual private key is not leaked to the attacker. Rather, a SSLv2-enabled server allows you to build an oracle with which you can decrypt a TLS connection (modern crypto, secure, etc.) to a server that uses the same k
889.
by pfg 11y ago
I didn't find any affected CloudFlare sites on their test site, so I assume they don't allow SSLv2 connections. You should probably patch your origin servers anyway.
890.
by pfg 11y ago
ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL Does this just disable all SSLv2 ciphers, or disable SSLv2 via SSL_OP_NO_SSLv2? The former might not be enough, unless your OpenSSL version includes fixes from 1.0.2f and g.
891.
by pfg 11y ago
Note that the private key isn't actually leaked (as opposed to Heartbleed), so it wouldn't be necessary to revoke the old certificate and use a new key. Rather, DROWN uses an existing SSLv2 service with the same key as an Oracle t
892.
by pfg 11y ago
It would depend on exactly how the code disables SSLv2 - if it just disables all SSLv2 ciphers, you're SOL, see my other comment: https://news.ycombinator.com/item?id=11202785
893.
by pfg 11y ago
OpenSSH is a different project that doesn't use OpenSSL, so that's not affected. As for other software, it depends on the defaults and how their code disables SSLv2 (i.e. whether they just disable all SSLv2 ciphers, or disable the
894.
by pfg 11y ago
I think it's a little bit more complicated than that, and depends on how SSLv2 was disabled. From the OpenSSL 1.0.2f release notes: SSLv2 doesn't block disabled ciphers A malicious client can negotiate SSLv2 ciphers that ha
895.
by pfg 11y ago
Typically, most server software has configuration options that allow you to specify which protocol versions are permitted (i.e. ssl_protocols in nginx, SSLProtocol in apache). Sometimes, they also bring defaults that are stricter than what
896.
by pfg 11y ago
> [edit 2] according to one of the researcher, the scanner "check if pubkey (not cert) runs on SSLv2. Then mark all others with that pubkey vuln" (src: https://twitter.com/seecurity/status/704665265712
897.
by pfg 11y ago
The problem seems to be Java/Oracle's root store, where IdenTrust is not included. Let's Encrypt has stated that they have applied to Oracle's root program with their own root certificate, so hopefully this will eventual
898.
by pfg 11y ago
> This is all just theatre. The real motivation is to control the platform: to ship a piece of hardware that dictates who can install stuff on it, instead of the traditional hardware that lets you completely overwrite everything in it if
899.
by pfg 11y ago
Would be happy to help! Email on my profile (sorry, didn't find yours).
900.
by pfg 11y ago
The same could be said for certain vulnerabilities in Tor: Exploiting them could be illegal under the CFAA (unless you're a LEA with a warrant).

More ›