Viewing profile — NicolaiS

> "make your clients trust the CA" There's no single trust store: the OS has one, Firefox, Java (cacerts), Python (certifi), Node, Go containers, all your Docker images, ... Failur…

badssl.com is an amazing tool especially for testing "TLS intercepting" boxes. I've seen more than one fortune 500 company that re-sign certain broken certs with their own CA, allo…

This exists, but not very well supported: https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.... But DNSSEC + SSHFP is a better supported solution at the moment

> Have mitmproxy gotten any better in usability over the years? The new-ish "Local Capture" and "WireGuard"-mode are quite nice. And running e.g. `mitmproxy --ignore-hosts '.*' --s…

TLS inspection can _never_ be implemented in a good way, you will always have cases where it breaks something and most commonly you will see very bad implementations that break mos…

Got acquired by a Fortune 500 and recieved new laptop. First hour I'm seeing TLS errors everywhere except the browser. They'd half-baked their internal CA rollout, so wasn't truste…

Do you have any sources that the infected USB contained AV updates? I can't find any sources saying that..

Note that this requires an authenticated user, so most redis installations are not directly at risk. The github issue has these workarounds: > An additional workaround to mitigate …

was pi: raspberry, but it was changed a long time ago to have no default user:pass

I guess a bunch of "roll your own X.509 validation"-logic will have that bug, but to exploit it you need a misbehaving CA to issue you such a cert (i.e. low likelihood)

After the Linux Foundation became a CNA (CVE Numbering Authority), it started issuing CVEs for a broad range of "vulns", such as local denial-of-service, memory errors with no viab…

Parent comment writes: "ship[ing] the tree root hash", for a merkle tree ("bitcoin style") this would just be a single (small) hash no matter the tree size, i.e. 32 bytes is enough…

Agree Caddy even supports 'ACME profiles' for people that want to follow the latest recommendation from CAB / want shortlived certs

Another approach that avoids symlinks and avoids a git repo in $HOME (i.e. everything is a subdir of that git repo) is to use the option "git-dir" to clone into a subdir, e.g. `$HO…

A confidential channel can be established over an insecure medium using e.g. Diffie-Hellman key exchange. To protect against MITM, an out-of-band QR/bluetooth can be used.

Biggest reason to avoid DES is the short key. Double-DES doesn't fix that due to the meet-in-the-middle attack. Triple DES "solves" the short key problem.

beg bounty hunters

Amazing to see post-quantum crypto (PQC) by-default, and support for Encrypted ClientHello (ECH) and ACME Profiles!

This will not work as any attacker that can MITM the client (likely scenario for end-users), can also MITM this "certificate issuing" setup and issue their own cert. The reason an …

Sorry, but this will never work very well. The tool contains a bunch of "denylist regexes", i.e. `user (should not|must not|cannot) see` But these can easily be bypassed. Any real …

Self-hosting Conduit as my homeserver using SQLite as by database and Caddy as reverse proxy. That is: 2 binaries (conduit + caddy) + 5 lines of toml config for Conduit and 2 line …

A note for Ubuntu users; if Firefox is installed using `snap` (default) and you run `snap refresh` it will output "All snaps up to date" - but this is not true! You have to close f…