Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Senator requests better https compliance at US Department of Defense [pdf]

wyden.senate.gov

Post reply on HN
Print view View original

31–40 of 56 posts

Re: Senator requests better https compliance at US Department of Defense [pdf]

#31

Post by craftyguy »

Rafuino wrote: post #6

Used to work in the Senate and have always admired Senator Wyden and his staff when it comes to being up to date on important technical issues like net neutrality, domain name governance, data breach law, cybersecurity standards, and now this. If you have specialized technical knowledge that can inform policy of importance (your call on how to judge that), I encourage you to engage your senators/reps on such issues,…

Well, I would encourage my senator on such issues, but my senator is Wyden. Here goes another "thank you, keep up the good work" letter.

Re: Senator requests better https compliance at US Department of Defense [pdf]

#32

Post by zjs »

netheril96 wrote: post #14
ihattendorf wrote: post #7

AFAIK, the point of the DoD Root CA is to avoid trusting an external entity not to intercept military traffic. Most .mil HTTPS sites that are intended to be accessed by the public (like https://www.army.mil/ ) are signed by a regular Root CA, while internal sites use the DoD Root CA.

But any CA can issue certificates for any domain in our current system. Sure, you can always manually inspect the certificate and see if the root CA is expected. But does anyone do that at all?

Any CA can issue certificates for any domain, but they may not be permitted to do so.

Certification Authority Authorization (CAA) DNS records can be used to indicate which CA is authorized to issue certificates for a domain. The CA/Browser Forum requires all certificate authorities to check CAA records prior to issuance.

Re: Senator requests better https compliance at US Department of Defense [pdf]

#33

Post by westurner »

The "Mozilla SSL Configuration Generator" has a checkbox for 'HSTS enabled?' and can generate SSL/TLS configs for Apache, Nginx, Lighttpd, HAProxy, AWS, ELB. https://mozilla.github.io/server-side-tls/ssl-config-generat...

You can select 'nginx', then 'modern', and then 'apache' for a modern Apache configuration.

Are the 'modern' configs FIPS compliant?

What browsers/tools does requiring TLS 1.3 break?

Re: Senator requests better https compliance at US Department of Defense [pdf]

#34

Post by saghm »

craftyguy wrote: post #31
Rafuino wrote: post #6

Used to work in the Senate and have always admired Senator Wyden and his staff when it comes to being up to date on important technical issues like net neutrality, domain name governance, data breach law, cybersecurity standards, and now this. If you have specialized technical knowledge that can inform policy of importance (your call on how to judge that), I encourage you to engage your senators/reps on such issues,…

Well, I would encourage my senator on such issues, but my senator is Wyden. Here goes another "thank you, keep up the good work" letter.

You don't have two senators?

Re: Senator requests better https compliance at US Department of Defense [pdf]

#35

Post by knorker »

lern_too_spel wrote: post #29
rosege wrote: post #28

Earlier quoted context omitted.

According to Clapper he misunderstood the question and thought they were asking about something previously just asked. Heard him interviewed on the BBC just a day or so ago where they asked him about it - and he said he hasnt previously lied in the hundreds of times he's appeared so why would he now. So I guess ppl can make up their own minds.

The previous question was about whether the NSA builds dossiers on all Americans, which is a far cry from having a database of phone call metadata not linked to PII used to find phone numbers of associates of malicious foreign agents. Also, GP's timeline is backward. Snowden reached out to Greenwald four months before that hearing.

Uhm, phone call metadata is PII.

IANAL, but if you have phone call metadata and you think it's not in scope for GDPR then you'll be disappointed.

Re: Senator requests better https compliance at US Department of Defense [pdf]

#36

Post by tialaramex »

westurner wrote: post #33

The "Mozilla SSL Configuration Generator" has a checkbox for 'HSTS enabled?' and can generate SSL/TLS configs for Apache, Nginx, Lighttpd, HAProxy, AWS, ELB. https://mozilla.github.io/server-side-tls/ssl-config-generat... You can select 'nginx', then 'modern', and then 'apache' for a modern Apache configuration. Are the 'modern' configs FIPS compliant? What browsers/tools does requiring TLS 1.3 break?

Because TLS 1.3 is sat in the Editor queue patiently alongside other RFCs there isn't, or shouldn't be, any software compatible with TLS 1.3 today. Implementations of the Draft 23 or other editions are deliberately incompatible with and must be replaced by the real TLS 1.3 after the Editor is done with it even though (as it stands) they are otherwise functionally identical.

Re: Senator requests better https compliance at US Department of Defense [pdf]

#38

Post by IncRnd »

craftyguy wrote: post #31
Rafuino wrote: post #6

Used to work in the Senate and have always admired Senator Wyden and his staff when it comes to being up to date on important technical issues like net neutrality, domain name governance, data breach law, cybersecurity standards, and now this. If you have specialized technical knowledge that can inform policy of importance (your call on how to judge that), I encourage you to engage your senators/reps on such issues,…

Well, I would encourage my senator on such issues, but my senator is Wyden. Here goes another "thank you, keep up the good work" letter.

You can still encourage Sen. Merkley, since you have two Senators.

Re: Senator requests better https compliance at US Department of Defense [pdf]

#39

Post by Jedi72 »

ihattendorf wrote: post #7

AFAIK, the point of the DoD Root CA is to avoid trusting an external entity not to intercept military traffic. Most .mil HTTPS sites that are intended to be accessed by the public (like https://www.army.mil/ ) are signed by a regular Root CA, while internal sites use the DoD Root CA.

I opened this link in Melbourne, Australia, never been to this page before in my life, and it downloaded almost instantly. Do .mil domains get some kind of special preference, or is my brain just glitching out?

Re: Senator requests better https compliance at US Department of Defense [pdf]

#40

Post by discreditable »

Jedi72 wrote: post #39
ihattendorf wrote: post #7

AFAIK, the point of the DoD Root CA is to avoid trusting an external entity not to intercept military traffic. Most .mil HTTPS sites that are intended to be accessed by the public (like https://www.army.mil/ ) are signed by a regular Root CA, while internal sites use the DoD Root CA.

I opened this link in Melbourne, Australia, never been to this page before in my life, and it downloaded almost instantly. Do .mil domains get some kind of special preference, or is my brain just glitching out?

Their page is pretty light. It's served over http2 and about 1MB of mostly images. There's only 60K/200K (compressed/uncompressed) of Javascript.
Post reply on HN