Greetings everyone Christian Thornton, Last Year I applied for a loan but proved negative. My goal was to start up a business but due to my bad credit history I was unable get a loan. My credit score was 458 I had lapse in payments from states, so some stuffs went to collections some got charged off some 30/60 day late all credit card got maxed. While I was digging online for possible ways to get my credit fixed, I came across some article talking about this great credit specialist Ghost virus I was impressed. I quickly contacted him to get more understanding how it works we had a chat I was impressed from the details and he gave me. He requested some info from me which I provide, the process lasted for 2weeks they got my credit fixed with an excellent credit score I really appreciate you thanks. If you’re seeing this and you need a credit repair specialist then here’s the man to contact (GHOSTVIRUS7890@ GMAIL.COM +1 205 418 0498)
Safari will no longer trust certs valid for more than 13 months
121–130 of 179 posts
Re: Safari will no longer trust certs valid for more than 13 months
#122Earlier quoted context omitted.
I think you may not be very familiar with Let’s Encrypt’s challenges. Allow me to briefly explain the gist of them: The two most common challenges are an http challenge, and a DNS challenge. The http challenge gives you a response code to host as a file on the domain during the validation period. This challenge is, for all practical purposes, random, and cannot be guessed. Then, after your script tells Let’s Encrypt…
> DNS challenge is even more secure, in my opinion, as it works the same but the response code is stored in a TXT record for Let’s Encrypt to validate. In order to break this you would need control of the DNS servers. > Now let’s contrast this with, for instance, getting a multi-year certificate from the likes of Verisign or similar: this (as far as I am aware) requires manual interaction, which can at least theoreti…
> What I've never understood is how this doesn't ultimately just shift the security risk to my DNS registrar.
> Instead of social-engineering the CA to give me a cert, I have to social-engineer the registrar to store a TXT record. I don't see why one should be significantly harder than the other.
Rogue registrars aren't necessary: one can simply attack the registrar or interfere with the DNS traffic. These attacks have already been seen in the wild and are continuing today: check out info on DNSpionage (https://blog.talosintelligence.com/2019/04/dnspionage-brings...) and Sea Turtle (https://blog.talosintelligence.com/2019/04/seaturtle.html) attacks.
Meanwhile, Let's Encrypt has been making some interesting changes. For instance, they just introduced multi-perspective challenges (https://letsencrypt.org/2020/02/19/multi-perspective-validat...) in which they submit multiple challenges to the user from different network paths. Attackers hijacking network paths to interfere with challenges must then intercept all possible paths to a client, which is much harder.
That said, I'm not a fan of devolving our certificate validation to DNS--it's like building a castle on Jello. It wasn't designed to be a security-first protocol, and it's definitely showing its age.
Re: Safari will no longer trust certs valid for more than 13 months
#123Earlier quoted context omitted.
The criteria are very clear: - Safari - max 398 days
> The criteria are very clear: today . Tomorrow they may change to be 397 days, or 39.8 days, or "until the next iPhone is released".
Nope. Today, tomorrow and for 6 more months is 825 days. As of September 1, 2020, it will be 398 days - a change people knew was coming for a long time.
Re: Safari will no longer trust certs valid for more than 13 months
#124Earlier quoted context omitted.
CT didn't change this for bad guys. If you're a bad guy (or a neutral researcher with a budget for the data) you can buy what's called "Passive DNS". Several suppliers will give you a list of DNS requests and their answers, the identifying information for who made the requests is elided so it's not PII but it has the same effect of making the fact servername.example.com exists in effect public information. Even if yo…
Yes, which is why you used to be able to have fully internal domains that are served by an internal DNS server and are never seen on the public internet.
You can still have this: it's called 'split-horizon' or 'split-brain' DNS. It can be tough to set up and maintain for large DNS environments, but not /that/ difficult even at that level. If you do this and you don't want those names in the public CT records, though, you have to implement a private internal PKI for those servers so they're not getting public certs. Or use a wildcard, which carries its own significant security risks.
Re: Safari will no longer trust certs valid for more than 13 months
#125While I agree that it is better from a security perspective not to issue long lived certificate and that automation would be best, I dislike the fact that the subdomain of any certificate I issue becomes public due to Google's certificate transparency project. By making every subdomain public, it makes the job easier for any attacker wanting to try and find smaller servers to target. It's not that I believe in securi…
I think a lot of places do this for convenience, and don't realize the risk it puts them under (not that you are unaware of this, just that others may not be). Whether they have everything generate its own wildcard certificate, or create one wildcard and share it to everything, they've created a significant security risk. Namely, any time a wildcard cert and private key leaks, the attacker can now impersonate literally everything behind that name. By using wildcards everywhere, they're creating tons of leakage points, and only one of them has to leak the private key and the attacker wins, particularly if they can grab it without the user being aware.
Re: Safari will no longer trust certs valid for more than 13 months
#126Earlier quoted context omitted.
CT didn't change this for bad guys. If you're a bad guy (or a neutral researcher with a budget for the data) you can buy what's called "Passive DNS". Several suppliers will give you a list of DNS requests and their answers, the identifying information for who made the requests is elided so it's not PII but it has the same effect of making the fact servername.example.com exists in effect public information. Even if yo…
Yes, which is why you used to be able to have fully internal domains that are served by an internal DNS server and are never seen on the public internet.
You could create your own CA, limited to your domain and install it on the respective devices.
Re: Safari will no longer trust certs valid for more than 13 months
#127Earlier quoted context omitted.
I am telling you there is a conspiracy going on to end the open and free web. We should fiercefully start to fight back otherwise those who made the internet great (the open source hackers working on LAMP) will loose everything.
I'll agree that modern mainstream browsers (and devices!) have an increasingly centralized security model that isn't at all conducive to an open web. But given the current state of the FOSS ecosystem, I'm not terribly concerned in the long term so long as the network layer remains open to all. (Consider: QtWebEngine, PinePhone, SiFive, OpenTitan, IPFS, DAT, Solid, ...)
I think the web is already a lost battle. It'll just take time (a lot of it) for the control to fully sink in. But I think that once this control becomes mainstream then there will be something else with more freedom. Some form of an alternate internet that will have barriers to entry. Something like tor. It'll probably be based on p2p.
Re: Safari will no longer trust certs valid for more than 13 months
#128Re: Safari will no longer trust certs valid for more than 13 months
#129There are two mutually exclusive views of the web. As a set of protocols to allow individual humans to share information about things they love and the web as a set of protocols to make a living. There are real reasons for the for-profit web to want to limited cert lifetimes since revocation doesn't really work in practice. In terms of browser dev the two views are mutually exclusive and the one that funds the coders…
> Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future. I mean... How do you expect to have a valid, trusted TLS certificate without a third party? Nobody says it has to be Lets Encrypt or Cloudflare or Amazon load balancers or ... so forth. Some certificate authorities even already have APIs....
No third party is strictly necessary.
You have to know what the servers public key is in a reliable way. That doesn't necessarily mean a third party has to be involved. Maybe you call them on the phone and check the fingerprint. Maybe it's your server and you sneakernet the key to your client. And to appease the dumb protocol you wrap it up as a certificate (self-signed) and accept yourself as trustworthy (what a concept!).
Even if you use a third party, it doesn't have to be some big company that everybody is functionally obligated to trust. It could be a mutual friend making an introduction.
And certificates are not the only or necessarily the right solution to this problem in all domains. For example, if you have to go and check OCSP every time to see if the certificate might have been revoked, then you are relying on an online trusted source; but if you have an online trusted source, why don't they just tell you the current key and dispense with the certificate mechanism altogether?
X.509 was designed for X.500 and concepts that were relevant for X.500 continue to plague us all. I deployed corporate PKIs back in the 1990s for Sun and Pfizer and worked with other clients. What I remember best from those times was how ridiculous the whole thing is, over-engineered by parties who clearly didn't keep focus on the fundemental problem that public key cryptography is meant to solve.
Re: Safari will no longer trust certs valid for more than 13 months
#130Earlier quoted context omitted.
With Let's Encrypt it's cheaper than ever to host a personal website over HTTPS with a certificate that updates itself. Due to Let's Encrypt, free hosting services like Netlify or GitHub Pages are now providing HTTPS certificates and installing it on your own server is pretty painless, if you're into managing your own server. And if your hosting provider doesn't support Let's Encrypt, you can always put Cloudflare in…
>So I don't really understand what you're talking about, That's because you didn't finish reading my post. >Expect to eventually be unable to host a visitable or indexable website without relying on at least one third party service in the near future.
You mean besides the fact that you need an ISP?