pfg

105 ms·

931.
by pfg 11y ago
Right, but the purpose of key pinning is to prevent a MitM from learning the plaintext, not Alice or Bob. There are any number of means an attacker could employ to reverse-engineer an API (decompilation, memory dumps, debuggers, ...). This
932.
by pfg 11y ago
I'm not sure I quite understand your point, but wouldn't an attacker with the ability to modify an app on someone's device have access to the plaintext anyway?
933.
by pfg 11y ago
Registrations don't cause a lot of load. They're essentially just one row in a table. Certificates have to be signed by a Hardware Security Module with limited capacity. OCSP messages have to be signed every couple of days for the
934.
by pfg 11y ago
Yes, private suffixes are included. It has already caused a spike in new PSL submissions[1]. You're right about this being rather easy to bypass, but the main goal is probably not to mitigate against abuse but rather prevent buggy auto
935.
Remote File System Access Vulnerability in Avast's Chrome Fork(code.google.com)
3 points by pfg 11y ago|1 comments
936.
by pfg 11y ago
Server support has landed, but there's no support in the official client yet (some third-party clients do support it). They're probably waiting for that to land before making a bigger announcement.
937.
by pfg 11y ago
Both apache and nginx support graceful reloads which will reload the certificates without any downtime.
938.
by pfg 11y ago
They use the Public Suffix List[1]. [1]: https://publicsuffix.org/
939.
by pfg 11y ago
Office setups: Deploy an internal root CA (possibly with appropriate name constraints, to limit the damage to internal domains if your CA key is compromised). Active Directory makes it relatively easy to do this. Tooling will hopefully get
940.
by pfg 11y ago
Certificates/Domain is the one that would affect this use-case the most. It's set to 5 certificates per domain per week. More specifically, it's certificates per TLD+1, so one certificate for customer1.example.com and one for
941.
by pfg 11y ago
That's correct, however there are rather aggressive rate limits in place right now that would make this hard for your typical SaaS-on-a-subdomain deployment if you have more than ~5 new signups per week. Plus, if SAN support is a conce
942.
by pfg 11y ago
If SAN certificates make sense for your setup (i.e. all used on the same server or for the same service), you can have up to 100 (sub)domains on one certificate, or basically 500 per week. Maybe that's how you managed to get more than
943.
by pfg 11y ago
https://istlsfastyet.com/
944.
by pfg 11y ago
The solution for shared hosting environments is for your provider to integrate with Let's Encrypt (or any other free CA that might pop up in the future). Once this change goes through, providers will be forced to either do that or (if
945.
by pfg 11y ago
SEPA direct debit allows you to pull money via IBAN (+ BIC, depending on the countries involved in the transaction). Specifics vary from country to country. Some require active approval from the customer (IIRC France, probably more), others
946.
by pfg 11y ago
> Techically the money OEMS have to pay covering certification does not go to Google. OP was referring to license fees, which google does not charge. Mandatory certification by a third party is different from that, and judging by the num
947.
by pfg 11y ago
About 1 billion Android devices were sold in 2014, versus less than 200 million iPhones. Even if we assume your number is correct, that means 250 million Android devices were sold to users in high-income countries. Even if we assume that 50
948.
by pfg 11y ago
I've never heard of this before, and previous leaks of the contracts between Google and OEMs[1] made no mention of this. I doubt OEMs would agree to those terms. As far as I know, the license only covers things like hardware and softwa
949.
by pfg 11y ago
I don't see how averages are relevant here. Android might have more usage among low-income users in certain countries, but in other countries (e.g. most of Europe) it has a vastly bigger market share, certainly not only because of lo
950.
by pfg 11y ago
Most HPKP deployments pin to root or intermediate certificates of CAs (usually 2 separate CA entities, in case something happens to the primary CA) - meaning in a typical scenario, the attack surface is approximately the same. Not sure if t
951.
by pfg 11y ago
IIRC authorizations (solved challenges) expire after 10 months, so you could get up to 13 months of certificate coverage out of one solved challenge. The official client doesn't support this yet, it will request a new challenge token o
952.
by pfg 11y ago
I'm not familiar enough with docker to comment on what the best solution would be. That being said, instinctively I would say that a certificate is something that should be provided to docker instances as part of the configuration and
953.
by pfg 11y ago
> - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? The client takes care of solving the ownership challenge, provisioning the certifi
954.
by pfg 11y ago
DNS validation landed in production yesterday[1]! \o/ The official client doesn't support it yet though; you'll have to use alternative clients. [1]: https://twitter.com/letsencrypt/status/6899195231
955.
by pfg 11y ago
I just signed up using my personal gmail address and was offered this option to verify domain ownership: http://puu.sh/mB373/62a963d896.png The file contains a random token. This is essentially the same solution Let&#x
956.
by pfg 11y ago
I don't think you understand how the CA system or Let's Encrypt works. IdenTrust signed Let's Encrypt's intermediate certificate[1] using their trusted root certificate. This intermediate certificate has the CA flag set,
957.
by pfg 11y ago
Static IP? Do you mean "one certificate per IP, unless you're okay with not supporting clients that don't use SNI"?
958.
by pfg 11y ago
This does not make sense, I'm not sure what you're trying to say. The cross-sign works on all major browsers. Domain validation as practised by Let's Encrypt is in accordance with CA/B Baseline Requirements, and they&#x2
959.
by pfg 11y ago
What you're saying is correct for connections from tor to cleartext sites. Hidden services are end-to-end encrypted. I'm not sure which cipher tor uses; maybe modern browsers are better in that respect.
960.
by pfg 11y ago
GitLab introduced a new web server (gitlab-workhorse) in 8.0 that's better at handling large HTTP requests. I would suggest upgrading (not just for that reason, there have been tons of improvements and security updates).

More ›