xurukefi

7 ms·

31.
by xurukefi 4y ago
How about something very pragmatic: Use the same key you use for your webserver, which already has a valid SSL cert. Clients first connect to port 443 to get the public key and can verify the certificate. During the SSH handshake, the clien
32.
by xurukefi 4y ago
> For ssh that doesn't really apply as clearly though. Do you think that DNS-based proof of ownership is not something that CAs would use for SSH certification?
33.
by xurukefi 4y ago
This is such a nice and pragmatic solution. And yet for some reason people would rather prefer the CA madness we know in the HTTPS ecosystem to be established in the SSH world. I understand that DANE was ahead of its time which is why we se
34.
by xurukefi 4y ago
Thanks for the feedback. It's certainly interesting to see that you did not find it helpful at all. I was oversimplifying so much that I felt uncomfortable about it because I feel like some aspects of my answer are just borderline wron
35.
by xurukefi 4y ago
It's strange if you come from Weierstrasser curves and think of public keys as points on the curve, which I think is what most people start with. I was obviously oversimplifying heavily.
36.
by xurukefi 4y ago
An extra titbit for anybody who is interested in this: The Weierstrasser curve used by Bitcoin (secp256k1) has an interesting public key where the secret key is 1/2. What's so special about this (apart from the fact that the key i
37.
by xurukefi 4y ago
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generat
38.
by xurukefi 4y ago
That's an interesting proof, because I can easily follow it mechanically, but I have absolute no intuition for it.
39.
by xurukefi 4y ago
I'm always (pleasantly) surprised to see that DNS sinkholing is still a viable option. Couldn't smart tv vendors or the like simply hardcode DNS resolvers and use DNSSEC or DoH (with certificate pinning) to circumvent it?
40.
by xurukefi 4y ago
I personally don't use LastPass due do their history of failures. My point is that the tweet in question and people around here are insinuating that attackers have gained access to unencrypted passwords in the infrastructure of LastPas
41.
by xurukefi 4y ago
You missed the point. maria2 is talking about whitebox crypto. The "whitebox" part means that the decryption process happens on your machine incuding the secrets, which are present in some obfuscated scrambled form in memory. Gett
42.
by xurukefi 4y ago
I would wait until more stories like this pop up before jumping to conclusions.
43.
by xurukefi 4y ago
Well, you would only need to compromise a dns zone once and sneak in your DNS record. If the actual owner of the domain/zone does not carefully watch their records and if they use a different verification method for their certificates,
44.
by xurukefi 4y ago
That's a different proof of ownership model, though. If I understand it correctly, you set the DNS record once and then forget about it. Hence, you will only prove that you had control over the zone at some point in time. With the DNS-
45.
by xurukefi 4y ago
In my experience, most technical people these days still don't know the difference between UTF-8 and Unicode for example.
46.
by xurukefi 4y ago
It always amazes me how controversial nutrition is. Almost 300 comments here on HN within 2 hours. This is basically like religion and politics.
47.
by xurukefi 4y ago
I'm not talking about success. I just stated that Mastodon is not going to be a replacement for twitter in the sense that it is never going to be a platform with hundreds of millions of active daily users, which is what (for some reaso
48.
by xurukefi 4y ago
I'm talking about mainstream adoption. Mastodon is never going to be anything more than a niche phenomenon. Similar to how odysee is never going to be the next YouTube, which is even more ridiculous that people believed that. If you wa
49.
by xurukefi 4y ago
It's absolutely beyond me how people believed (or still believe) that Mastodon will be a replacement for Twitter. That's a level of delusion I will never get behind.
50.
by xurukefi 4y ago
> Switch to a better ISP, problem solved. There are a lot of people in this world who can choose between exactly one ISP.
51.
by xurukefi 4y ago
> If the risk is that an ISP would spoof the entire website at AI, then that can be done regardless of HTTPS. No, an ISP cannot spoof a valid certificate for a website
52.
by xurukefi 4y ago
Serious counter-counter-point for anybody interested: HTTPS protects people from ISP-based MITM attacks. This by itself is more than enough reason to always use HTTPS if your website can be accessed by other people, even if it is just a sma
53.
by xurukefi 4y ago
Not sure if I'm missing the irony here.
54.
by xurukefi 4y ago
That's what I thought ... 8 years ago when I started using this website.
55.
by xurukefi 4y ago
In case you want to download genuine Windows ISOs you can use https://tb.rg-adguard.net . It's a simple website that uses some sort of MS API to generate download links (directly from Microsoft servers). AFAIK MS does not pu
56.
by xurukefi 4y ago
Unfortunately, side-channel attacks like this (or like Meltdown, Spectre, TLBleed, Foreshadow, etc...) only have negligible real-world impact. They are very interesting from a theoretical point of view, but are usually totally impractical f
57.
by xurukefi 4y ago
> To use that terminology though, your body could be said to have a "set point" that it aims for, but that "set point" can change. Which I acknowledged. You can decrease (or increase) your set point, but there is a li
58.
by xurukefi 4y ago
It's genetics. I think it's called the set point theory. You're genetically programmed to keep a certain body fat percentage. Anything below (or above) that set point and you're body will regulate your appetite with horm
59.
by xurukefi 4y ago
What's even worse is that a lot of people think that it is a great idea to check the TLD against the set of existing TLDs. Of course, nobody gets such a whitelist right or cares to update it if new TLDs are created. From experience I c
60.
by xurukefi 5y ago
That is also why cheating done by actually skilled people is really dificult to detect. Schmooey is a skilled guitar hero player and therefore he very well knows the limitations in terms of the results the competitive gh community will beli

More ›