Viewing profile — konklone

On isitchristmas.com, this happens for several days surrounding Christmas. The defined use case is informing you of whether it is Christmas.

The document distinguishes between enterprise-facing and public-facing systems. For enterprise-facing (government employees, contractors, etc.), it's talking about discontinuing us…

Login.gov does support identity verification. Not all uses of Login.gov require it, so many accounts are just used for email with MFA.

Author of the post here :) In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few g…

There's not federalism within states in a legal sense the way there is between states and the feds, but cities value their independence too and prefer to have their own infrastruct…

CLAs are frowned upon by some, but they don't completely kill contribution from 3rd parties. I've signed plenty, and I've encountered plenty of projects that use them that continue…

I wouldn't use the word "illegal" - it's a directive of OMB (the White House's management and budget office), not a law or a regulation or an executive order. The only true enforce…

The policy is still in effect, and its supporting home page is here: https://https.cio.gov

Cloud Foundry doesn't have a problem injecting headers, as HTTP traffic is plaintext inside the system itself. It's once it starts traveling across the public internet that encrypt…

Just so it's clear, NSA is technically part of DoD. (Though it's a bit like FBI's relation to DOJ, they operate very independently.) Also, the DoD CIO has had, since ~2003, this ex…

I'm from 18F, and I'm now a "contributor", but only because they accepted my pull requests. :)

In fact, there are now way more state/local .gov domains (~4,000) than federal .gov domains (~1,300).

Exactly.

What you're trusting the browser for there is the extra protection that preloading provides, but that's not the whole benefit here. The larger benefit is that it makes it infeasibl…

Very true. HPKP is not part of this change, and if you look at GSA's guidance on HPKP, it's cognizant of this risk: https://https.cio.gov/certificates/#http-public-key-pinning

Yes, I do know that hostnames are typically outside the HTTPS envelope. However, user-agent is not, and would be exposed (and could then possibly be correlated to other HTTPS traff…

@prodtorok - This is one of the nice things about HSTS. The includeSubDomains directive can create automatic client enforcement for all subdomains. If some component of an agency i…

To quote my comment from above - bear in mind that when it comes to plain HTTP, it's not just the system's confidentiality and integrity that you need to weigh against availability…

I wouldn't say this is reinventing the CA system. You don't need to trust any particular browser here. The effect is that web services must offer a secure HTTPS connection, using t…

Bear in mind that when it comes to plain HTTP, it's not just the system's confidentiality and integrity that you need to weigh: it's the user's confidentiality and integrity. That'…

Not quite either one -- it's technical enforcement by the TLD, but still done on a per-domain basis (this doesn't affect state/local .gov domains, or legislative/judicial .gov doma…

Let's Encrypt isn't specifically mentioned in the post, though the post hits the underlying point: > GSA provides extensive guidance to agencies on HTTPS deployment at https.cio.go…

Subdomains generally get automatically included when a second-level domain is preloaded. So, for .gov domains that fall under scope here, their subdomains will all have HTTPS enfor…

Second level domains. There are waayyyyy more subdomains, as you note. You can see some information and estimates on this here: https://18f.gsa.gov/2017/01/04/tracking-the-us-gover…