61–70 of 255 posts
I wonder if this was used to extract some private keys?
https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033
Earlier quoted context omitted.
If by "something you are comfortable with" you mean "reject web of trust". Trust is not transitive, which is the problem with web of trust. I trust a set of people. I do not necessarily trust the people those people trust.
If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).
While I maybe trust someone to be a real person after I've met them in real life and ate their spaghetti to give me back the 10$ they borrowed, I wouldn't trust them to verify the identity of the IRS for me.
The current solution is that we have some third parties which follow strict rules defined by themselves and browser vendors. Everyone involved has a very good incentive to remain trustworthy, otherwise they'd be out of business.
Sadly this doesn't prevent bottomfeeders like Trustico, StartTLS and others to leech of the system while some are genuinely interested in securing everyone's communication (see LE)
The Web of Trust only works if your trust in someone is binary and understandable to a computer, otherwise the browser might tell you "This website is 35.218% Trustworthy".
HTTPS trust must be binary. Either the cert is trusted or it isn't.
It's even more fun; GPG is considering to abandon the WoT. They're switching to TOFU instead, the first time you see a key it's trustworthy, similar to SSH.
Earlier quoted context omitted.
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
The first line of the blog post calls it SSL. It's irrelevant to what I said because I'm talking about the public key infrastructure.
Oh, it's worse than that: https://twitter.com/svblxyz/status/969220402768736258 You can run arbitrary shell commands as root from their webserver.
Cue the intro to Bohemian Rhapsody. This is a huge WTF. SQL injection? Too basic. We do raw shell injection now. To a CA. Welcome to the future of computers where security comes secondary to extra profits and marketing.
Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure
(Malicious ad injection + HTTP = mobile billing)
Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.
Link to Directive please?
(The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources)
Earlier quoted context omitted.
It sounds like Trustico got these certificates from Symantec. The CEO of Trustico was arguing that they should be revoked as they weren't secure and emailed the private keys as proof. Which, while a dumb thing to do, did prove his point I guess. EDIT: From Trustico's account > We believe the orders placed via our Symantec account were at risk and were poorly managed. We have been questioning Symantec without response…
Why would they not try to transition their customers to new certs _before_ getting all the old certs revoked though? Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.
Earlier quoted context omitted.
Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
It's not quite as bad as calling JS Java or vice versa, it's more like saying Java and then saying Java 1.2 and Java 1.8 and so forth.
Earlier quoted context omitted.
All you've told me is you don't understand web-of-trust.
Could you help us out by explaining what this comment is misunderstanding?
I'm not saying WOT solves all of our problems. It only makes it slightly better than verifying every key yourself. But it's better than the CA model because you can make it work for you.
Earlier quoted context omitted.
Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past.
We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle.
Or last weekend, when a friend asked me, "Hey, could you move your car so can get out?". While I could have stood there arguing with him or correcting him (since my car was actually at home, in my driveway), I instead went out and moved my truck so that the other guest could leave.
This excessive, unwarranted pedantry is annoying as hell. You may be "technically correct" but you make everyone around you dislike you.