131–140 of 255 posts
In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033
Earlier quoted context omitted.
This probably happened because they allowed users to execute root commands on their server. Either they quickly shut down the site or someone else did it by shutting down some servers. > https://twitter.com/svblxyz/status/969220402768736258
Oh my. There must be some sort of hall of fame for security vulnerabilities. And this belongs in it. Perhaps they’re passing this command to a secured container? I shouldn’t make excuses for them, but passing root commands to the shell seems too far out there.
That would indicate they were concerned about shell injection while writing the code. But if that were true, why would they skip the much simpler step of sanitizing/escaping the input?
Browsers need to remove all CAs except Let's Encrypt. CAs have proven again and again to be ridiculously insecure, and the problem is that there is no penalty for their mistakes. So just remove them all, after a warning period: Let's Encrypt is enough. Or if they want to stay in business and be trusted by browsers, then require them to put up at least $100k in cash in escrow for each certificate they sign, which is f…
Yeah, Let's Encrypt doesn't support OV or EV certs...
Although it's unlikely that's of any use, since unsophisticated users aren't going to differentiate, and sophisticated ones can use other means to verify identity.
> TL;DR: Forget your EV or other certs. Just run “Let’s Encrypt”. The author has a fundamental misunderstanding of the situation [1]. Trustico's awful decisions regarding a) storing customers private keys and b) improperly handling key material Have no bearing whatsoever on EV certs, which verify the legal entities that run websites. This is like saying Trustico is bad, therefore HTTPS is bad. [1] Assuming this is wh…
In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033
They are running the good old php shell of "". As root. As a security company.
This entire company is just blowing my mind at the moment. What's next, are they running their services on a notebook in the office?
In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033
Someone might have rm -rf / --no-preserve-root'd them! :)
;-)
I think we should use ssh instead of SSL and also ssh instead of username/password pairs. If somebody is doing a distributed chat/social system, I would use ssh if I were them. By ssh I don't mean execution commands but rather encryption/authentication framework.
There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden.
I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rotate a secret.
If this isn't what you meant, that we should use TOFU vs Trusted third party, please do expand.
Earlier quoted context omitted.
> Browsers need to remove all CAs except Let's Encrypt. No. I love Let's Encrypt, but we can't put all our eggs in a single basket like that. Now, if we could somehow foster multiple non-profit organizations like Let's Encrypt, but run under the aegis of different boards and sponsors, I'd be 100% for this idea. It's very odd that companies for whom CAs business is quite literally a money printing operation can't be b…
Security requires that ALL CAs be secure, since any compromised CA can compromise all websites (barring fragile schemes like pinning or certificate transparency checks), so the less CAs there are, the more secure the system is. It's like a building that needs secure doors: it's better to invest in a single, massive, bulletproof, guarded door rather than inviting anyone who meets some standards to add a door to the bu…
In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033
Someone might have rm -rf / --no-preserve-root'd them! :)