pfg

105 ms·

961.
by pfg 11y ago
> The only country where Holocaust denying is out right banned is Germany beyond that only France has a law that specifically protects against antisemitism. It's actually 14 European nations according to Wikipedia. Some have more ge
962.
by pfg 11y ago
If malware has write access to your certificate store, it is likely that it could also modify your certificate store or browser in a way that would bypass this warning.
963.
by pfg 11y ago
What you're saying is true, but in the context of CAs, it's still important to be able to distinguish real public suffixes from regular authority delegations for subdomains. CAs need to be able to filter and block CSRs for wildc
964.
by pfg 11y ago
No, with Let's Encrypt you would have to have full control over contents of login.wifiprovider.com to get a certificate for that domain. Specifically, you'd have to be able to serve a token at http://login.wifiprov
965.
by pfg 11y ago
Yes, Let's Encrypt does support CAA. Not sure about other CAs.
966.
by pfg 11y ago
It's completely unclear whether what you're saying is factually correct. If the attacker controls the bank's DNS, which seems likely given that they're able to create an A record for a subdomain, they can likely also add
967.
by pfg 11y ago
This is already possible using CAA DNS records, which can be used to define which CAs should be permitted to issue certificates for a domain.
968.
by pfg 11y ago
WoSign is one of the other CAs offering this option. It is unclear to me how TXT verification would have prevent this. The article indicates that the attackers created the subdomain and pointed it at a server they controlled; this means DNS
969.
by pfg 11y ago
This is one of many verification mechanisms other CAs offer. A lot of them also offer verification via DNS TXT record, or by placing a file under a certain path and verifying it's being served via HTTP. Let's Encrypt is definitely
970.
by pfg 11y ago
Pinning, as implemented by major browsers[1][2], doesn't prevent this. Private trust anchors are exempt from key pinning. This is deemed acceptable because in order for the proxy root to be trusted, it would have to be installed on you
971.
by pfg 11y ago
"Breaking" the browser for a large number of users will only lead to one thing: Users switching to a browser that still supports SHA-1 certs issued after Jan 1st, 2016. No privacy improvement there either. Additionally, there are
972.
by pfg 11y ago
Corporate proxies aren't the issue here; Outdated corporate proxies and other "security" software still issuing SHA-1 certs is what's causing this.
973.
by pfg 11y ago
This makes sense, thanks. Pity this wasn't brought up in the documentary, it's not like there weren't plenty of other weird things going on.
974.
by pfg 11y ago
OVH is hard to beat when it comes to raw performance/$. Hardware and network has been quite reliable for me (using SoYouStart and OVH), and their DDoS filter is excellent. I'm not really familiar with their cloud/VPS offering
975.
by pfg 11y ago
During the inspection of said package by the defense attorneys, they mention having asked the staff whether a hole in the lid should be expected, to which they replied "we don't do that". This was the "Okay, this documen
976.
by pfg 11y ago
> There doesn't seem to be a way to say "I have my big boy pants on, don't let anyone in under any circumstances". This is the first 2FA setup I've seen that still allows bypass by contacting support. Sadly, this
977.
by pfg 11y ago
Where are you reading this? When he says he was writing ColdFusion, he's referring to the framework/programming language. He's not saying he wrote every single line of Linode's management interface.
978.
by pfg 11y ago
Mozilla recently donated $25,000 to Discourse to improve mailing list support[1]. Hopefully it will pay off! [1]: https://blog.mozilla.org/blog/2015/12/10/mozilla-open-source...
979.
by pfg 11y ago
It seems to me like 2FA would've certainly affected the outcome in this particular case, and probably many other scenarios.
980.
by pfg 11y ago
Improve the UI for things like recovery codes in ways that essentially force users to print them. One thing I've seen out there is asking the user for a recovery code during the login process a few days after enabling 2FA (with an opti
981.
by pfg 11y ago
The article does specifically mention that he has taken steps to protect himself from stuff like this (i.e. require in-person confirmation with his utility providers, etc.). 2FA is certainly a valid response here, and requiring this even fo
982.
AVG: “Web TuneUP” extension multiple critical vulnerabilities(code.google.com)
246 points by pfg 11y ago|109 comments
983.
by pfg 11y ago
Interestingly, that's already kind of available in some countries. I live in Austria, where we have a system called Bürgerkarte which utilizes PKI. One of the supported options are ATM cards (others being public health insurance card
984.
Dbound: Organization Boundaries in the DNS(tools.ietf.org)
2 points by pfg 11y ago|0 comments
985.
by pfg 11y ago
Regarding device synchronization, I wonder if having per-device certificates with something similar to 2FA, where you have to confirm the new certificate on a device with an already-trusted certificate, wouldn't be a better option. Thi
986.
by pfg 11y ago
Totally agree that this is not optimal, but bear in mind that the goal is to get letsencrypt shipped through your package manager, where it can just specify dependencies and the package manager will resolve them. With that, this will essent
987.
by pfg 11y ago
Privacy isn't the only argument in favour of HTTPS everywhere. There's way too much unencrypted metadata even in a HTTPS connection - just the destination IP alone gives away a lot. The main argument for me is authenticity - no on
988.
by pfg 11y ago
You can still do that with HTTPS. Squid supports HTTPS proxying. Basically, you create your own root CA, distribute it to all endpoints on your network, and use squid to MITM all connections. That's (essentially) how most corporate pro
989.
by pfg 11y ago
Deploying HTTPS on a site with tons of legacy components, third-party dependencies and a lot of ad networks is definitely no small feat. There's a reason why most news sites are still HTTP-only.
990.
by pfg 11y ago
Wasn't it the anaesthetist who was unwilling to work late in this story, not the brain surgeon?

More ›