101–110 of 143 posts
In the a world of state surveillance and invasive data practices by SV based companies it's a difficult to understand this obsession with http scaremongering by some to perpetuate more centralization.
Earlier quoted context omitted.
But how am I supposed to know if I can trust it if it is the first time I am using it?
I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)
SSH actually follows the same model as SSL in this respect. It's just that basically everyone goes self-signed and there isn't a big institutional system to distribute SSH CA's.
It's more common in enterprisey environments where you have config management to distribute the CA but you can do it right now https://www.lorier.net/docs/ssh-ca.html
I thought this had been the case for a while now? I swear I've seen this headline 10 times in the last two years.
For example, a while back Chrome changed their porn viewing mode ("Incognito") to label HTTP Not Secure, and changed normal mode to mark pages Not Secure if the user seems to be filling out a form.
Bye bye chrome. You were useful until you started pushing your agenda on everyone
https://blog.mozilla.org/security/2017/01/20/communicating-t...
Earlier quoted context omitted.
I found this script to manage your local CA: https://github.com/FiloSottile/mkcert
You can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa
Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?
If you need to simulate HTTPS for your local host, but you actually control all the moving parts (e.g. a dev environment) you can use any private key + associated certificate for a DNS FQDN you control, then use /etc/hosts or its moral equivalent to tell your local machine that this name is on the local loop, and the key + certificate will validate.
You must not ship this as a "product" because when you do that all the end users end up with the private key, which both destroys the whole _point_ of public key cryptography AND violates the terms of whichever CA issued you with the certificate.
Earlier quoted context omitted.
Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties
But how am I supposed to know if I can trust it if it is the first time I am using it?
Earlier quoted context omitted.
DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.
Earlier quoted context omitted.
Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here. And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.
Um, good? If people avoid your site because its not secure, maybe you should fix it?
Earlier quoted context omitted.
DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.