101–110 of 290 posts
- 8 is a lucky number and a power of 2
- 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout
- 6 is the value of every digit in the number of the beast
- I just don't like 6!
Earlier quoted context omitted.
“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.
Makes sense. I assume each of them is in control and at the whims of US president?
ZeroSSL/HID Global seems to be quite multi-national though, and it’s owned by a Swedish company (Assa Abloy).
I don’t know what what kind of mitigations these orgs have in place if the shit really hits the fan in the US. It’s an interesting question for sure.
Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.
* https://datatracker.ietf.org/doc/html/rfc9799
* https://onionservices.torproject.org/research/appendixes/acm...
It's a huge ask, but i'm hoping they'll implement code-signing certs some day, even if they charge for it. It would be nice if appstores then accepted those certs instead of directly requiring developer verification.
2) App stores review apps because they want to verify functionality and compliance with rules, not just as a box-checking exercise. A code signing cert provides no assurances in that regard.
Earlier quoted context omitted.
Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation 's 10.0.0.1 and not bad-org 's 10.0.0.1.
A public CA won’t give you a cert for 10.0.0.1
If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?
No, they will only give out certificates if you can prove ownership of the IP, which means it being publicly routable.
How are IP address certificates useful?
* DoT/DoH * An outer SNI name when doing ECH perhaps * Being able to host secure http/mail/etc without being beholden to a domain registrar
Earlier quoted context omitted.
I mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.
Also I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation 's 10.0.0.1 and not bad-org 's 10.0.0.1.
Next, I hope they focus on issuing certificates for .onion addresses. On the modern web many features and protocols are locked behind HTTPS. The owner of a .onion has a key pair for it, so proving ownership is more trustworthy than even DNS.
But isn't it unnecessary to use https, since tor itself encrypts and verifies the identity of the endpoint?