pfg

23 ms·

181.
Apple served with warrant to unlock the Texas shooter’s iPhone SE(9to5mac.com)
2 points by pfg 9y ago|0 comments
182.
by pfg 9y ago
The problematic bit is that the browser itself would prompt you for your master password. Getting users into the habit of entering their master password in a browser window means that it's relatively easy for sites to create a fake pro
183.
by pfg 9y ago
This is an often overlooked option, but you can indeed solve the DNS challenge by having someone create a CNAME record for _acme-challenge.example.com that points to a domain under your control, and then serve the TXT record needed to verif
184.
by pfg 9y ago
The network equipment failure was due to a software error[1]. I would not rule out some kind of cascading failure triggered by the initial outage until the cause of the bug is known, though OVH seems comfortable with such a statement. [1]:
185.
by pfg 9y ago
> No expert on the field but that's the first time I can remember that a provider of that size loses connection to most of their data centres at once. It happened to GCE last year[1], though it only lasted 18 minutes. [1]: https:&#
186.
by pfg 9y ago
It's the location of one of their data centers. SBG for Strasbourg.
187.
by pfg 9y ago
It seems more likely that their data centers aren't quite as isolated as they thought they'd be. The outage also appears to be limited to their locations in Europe.
188.
by pfg 9y ago
We have a similar system in Austria and I got curious when ROCA was announced. Turns out the cards here generate ECDSA keys and are thus not affected. Naturally, there was no announcement of any kind, so this took quite a bit of sleuthing t
189.
by pfg 9y ago
I'm not certain what the implementation status is in various browsers, but the relevant RFCs (e.g. for HPKP) typically recommend that user agents retry the submission of reports. The report URIs themselves may also use HPKP to prevent
190.
by pfg 9y ago
This would only make sense under the assumption that the DNS response can be trusted. For the vast majority of domains and resolvers, that would not be the case. (I'm skipping the discussion of whether you'd want to trust DNSSEC a
191.
by pfg 9y ago
> Would you mind sharing how long your browser was sending CSP reports to 3rd parties before you knew about it? I'm not sure what you're asking - when did I become aware of this possibility? I guess when I learned about CSP? &g
192.
by pfg 9y ago
I don't understand the argument that it's bad because it leaks the IP address to a third party. So would embedding any other resource hosted on a different domain - from JavaScript CDNs to images. No one is suggesting these should
193.
by pfg 9y ago
The deprecation timeline is being synced with the rollout of CT and CT enforcement headers (Expect-CT). This provides roughly the same detection (if not prevention) capabilities.
194.
by pfg 9y ago
It would be a violation to do it with Comodo's publicly-trusted PKI, yes. You can do whatever you want with a private root that's manually deployed to the clients within your network.
195.
by pfg 9y ago
This would be a violation of root policies and would certainly cause the CA to be distrusted nowadays. It would also be detected with a high likelihood due to HPKP (and CT in the future). The economics of buying a CA for this purpose don&#x
196.
Francisco Partners Acquires Comodo's Certificate Authority Business(eweek.com)
49 points by pfg 9y ago|24 comments
197.
by pfg 9y ago
I'm generally a fan of this method and have picked it for a couple of projects in the past. With relatively long session lifetimes, the UX is acceptable for many use-cases. One thing worth pointing out is that the algorithm as describe
198.
by pfg 9y ago
> Curious, why future versions of chrome would not force CT for official TLDs? This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they
199.
by pfg 9y ago
IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enforcement. Naturally, you can just not install the root certificate, but if all tr
200.
by pfg 9y ago
You would indeed have to use the attacker's key until the pins of all visitors who visited the site during the attack expire. I believe the maximum HPKP max-age in Chrome is 2 months, it might be longer in Firefox. There is no mechanis
201.
by pfg 9y ago
Removing dynamic pins was inevitable given the associated risk for all sites. Some ideas to fix those exist[1], but I'm not sure it's worth the effort in a fully CT-enforced web. That's probably time better spent somewhere
202.
Equifax Was Warned(motherboard.vice.com)
26 points by pfg 9y ago|5 comments
203.
by pfg 9y ago
> If it's not a EV certificate, the browser user interface changes and a security-conscious user may notice. This is often used as an argument by EV advocates, but it doesn't hold up under scrutiny. An attacker with access to a
204.
by pfg 9y ago
The lack of code signing in web apps and the added attack surface of having your web and application server (which are in control of the code that users run) exposed to the internet matter a lot in this context. Attacks on build systems of
205.
by pfg 9y ago
The Stanford case is a really good (and chilling) example of what victims of these crimes can go through. This is the letter the victim read to the rapist at his sentencing[1]. [1]: https://www.buzzfeed.com/katiejmbaker&#x2F
206.
by pfg 9y ago
I'm not entirely sure if mastodon.social has published any policy clarifying how and under what circumstances they apply instance bans. There are two ways administrators can block other instances on Mastodon: Silence: Posts from users
207.
by pfg 9y ago
That's accurate, yes. It's easy to import and export things like users you follow and blocks, but not timelines or your own followers (they'd have to refollow). There are efforts under way to change this[1]. [1]: https:&#x2F
208.
by pfg 9y ago
There's some work being done to support "nomadic identities" via Decentralized Identifiers (DIDs)[1] in ActivityPub[2]. I'm not sure about the current status is, and whether Mastodon plans to implement it, but this could
209.
by pfg 9y ago
It would probably be possible to run the app server and background worker with about 1 GB of RAM. You might have to restart the workers daily to avoid OOMs (ruby/rails/puma will leak memory, you'll just accept that at some po
210.
by pfg 9y ago
One CPU would be fine with just one user, but that's not enough RAM. I would consider 2GB the bare minimum, with one app server instance and one background worker process (sidekiq) running.

More ›