pfg

25 ms·

211.
by pfg 9y ago
A number of CAs are working on ACME server implementations, based on posts on the working group mailing list. There are a couple of reasons why none are available today. First, ACME isn't quite standardized yet. Let's Encrypt curr
212.
by pfg 9y ago
That's weird. I bought two YubiKeys on amazon.co.uk about 1.5 years ago and was able to use the replacement form on Yubico's site (the one that asks for three OTPs) to order replacements directly from them.
213.
by pfg 9y ago
The idea is to make HTTPS the default before that happens. In the meantime, you can fit a lot of domains into bloom filter-like data structures.
214.
by pfg 9y ago
All major browsers implement HSTS preloading, and getting added is quite simple. A very large percentage of your average internet user's traffic is covered by this.
215.
by pfg 9y ago
Fortunately, SSL/TLS (with HSTS) does not depend on your local DNS resolver being secure.
216.
by pfg 9y ago
To be fair, these two examples are both on the extreme end: The Nexus 5 being one of the longest supported Android phones on the market, and the 5C having a rather short support period, compared to other iPhones like the 5S, which was relea
217.
by pfg 9y ago
Perfect is the enemy of good. A large portion of sensitive traffic is protected by HSTS today, and the preload list compresses well. By the time it'll become a problem, we'll hopefully be at the stage where HTTP is treated as inse
218.
by pfg 9y ago
All major browsers implement a HSTS preload list[1] to get around the first connection problem. Manually deleting the HSTS pin for a site is quite involved and not something I'd expect most users to do. [1]: https://hstsprel
219.
by pfg 9y ago
https://www.keylength.com/ presents the recommendations from various best-practice documents for many key types and cryptographic operations.
220.
by pfg 9y ago
I used to run into this regularly as well, usually with gpg-agent refusing to work. I recently switched to a 4C Nano, which made it quite cumbersome to pull the key, so I looked into it and found out that reloading gpg-agent does the trick
221.
by pfg 9y ago
Looks like it's built on top of kbfs[1]. [1]: https://keybase.io/docs/kbfs/understanding_kbfs
222.
by pfg 9y ago
Having used a MacBook Pro with a Touch Bar for about 10 months now, I'll have to agree that it didn't really improve my UX in any meaningful way. I have tried various customization tools, but I don't find myself using it for
223.
by pfg 9y ago
> If you're configuring a public facing server, a cronjob should not be considered "specialised knowledge". Knowing how HAProxy's OCSP implementation works (i.e., by looking for a $cert.ocsp file) is the specialized k
224.
Hardening Apache Struts with SELinux(doublepulsar.com)
2 points by pfg 9y ago|0 comments
225.
by pfg 9y ago
> There is literally zero configuration required for HAProxy. You just store .ocsp files alongside the .pem's > Yes you need to fetch them regularly. I use the aforementioned shell script to do this. It does sound like there&#x27
226.
by pfg 9y ago
As someone who occasionally helps people with their web server/TLS/Let's Encrypt configuration, my experience is that there is a world of difference between a web server merely giving you the tools you'd need for a (rela
227.
by pfg 9y ago
The W3C is working on this in the Web Authentication (webauthn) working group.
228.
by pfg 9y ago
Not only that, but they can also register as a payment provider in the user's browser, allowing for a convenient checkout flow on any site that uses Stripe.
229.
by pfg 9y ago
The maintainer of the HSTS preload list wrote a detailed report on the current state of HSTS preloading last year, covering the list size aspect[1]. [1]: https://docs.google.com/document/d/1LqpwT2aAekrWPtLui5GYdHSG
230.
by pfg 9y ago
Mozilla uses Chrome's HSTS preload list. (Microsoft too.)
231.
by pfg 9y ago
Children in various age groups have numerous rights that go far above education and health care in many countries, from the right to privacy to things like religious freedom. Saying that parents should have full control over their children&
232.
by pfg 9y ago
I'm not sure I understand your suggestion. How does the intermediary key improve the domain validation process? There's an CAA extension in the works that will allow you to bind domains to ACME accounts (which are protected by you
233.
by pfg 9y ago
Fun fact: one of the "independently-operated and audited subordinate CAs" that is exempt from this is, yep, you guessed it, Google. They've recently acquired a GlobalSign root and are in the process of getting their own roots
234.
by pfg 9y ago
> Another thing is, let's say I use some other CA for my certs, and I don't want LetsEncrypt issuing any. I can't really stop them, can I? You absolutely can. Let's Encrypt was one of the first CAs to support CAA (and
235.
by pfg 9y ago
> Considering that literally anyone who roots any server at all, or can spoof one - even servers that have never used LetsEncrypt before - can generate new valid LetsEncrypt certificates, and nothing generated has a password on it, I don
236.
by pfg 9y ago
> Let's hope that's not literally the encryption key, but the alternative -- it's a token used to lookup the key in their database -- would completely defeat the purpose of encrypting the PII with a PBK in the first place?
237.
by pfg 9y ago
The issue you describe most commonly happens to free (Gmail) accounts. Drive File Stream is only available for GSuite customers, and even those still have the option to continue using Backup and Sync (which is the Google Drive replacement f
238.
by pfg 9y ago
Not to say that there aren't valid reasons to think twice about relying exclusively on Google, but the title is slightly misleading in that Google isn't really deprecating Google Drive with no replacement, but rather introducing b
239.
by pfg 9y ago
All experts I've heard from on this agree that we're decades from being able to implement such systems in a secure way, if it's possible at all. Most people trying to tell you that's not true are trying to sell you somet
240.
by pfg 9y ago
That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.

More ›