181–190 of 307 posts
Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local) Only then we can have 100% of the web encrypted.
It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs [0] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1] https://hstspreload.org/ [2] https://securi…
Couldn't something like a TXT record also address this, but on a cross-client, scalable fashion? Like how SMTP with SPF or DKIM works right now.
(And yes, I know DNS also has trust problems!)
At the very worst, a central, programmatic source of truth, like DNSBL and company... just like how Google offers their "malware sites" hash table for all to use.
That edit, about NatWest buying up the example domain to "fix" the problem, gave me real good laugh. It's interesting how simple mindedness can be so unexpectedly expected.
My sides.
It's 2017, and my social media account is protected by a tamper-proof phish-resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters. The future is here folks. And it sucks.
Look at Mr. PrivateBanking over there, my one is 5. Amount in words : Five.
And that is after they updated all their software and moved to a new datacenter and everything recently.
Granted I have a hardware dongle to authenticate any transactions, but to gain access to all my information, five characters is all the protection they wish to offer...
Earlier quoted context omitted.
It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs [0] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1] https://hstspreload.org/ [2] https://securi…
I was excited until I realized that HSTS Preload is just a hardcoded list in the Chrome source!? Ugh, that's sort of disappointing :( Couldn't something like a TXT record also address this, but on a cross-client, scalable fashion? Like how SMTP with SPF or DKIM works right now. (And yes, I know DNS also has trust problems!) At the very worst, a central, programmatic source of truth, like DNSBL and company... just lik…
DNSSEC has no practical impact on this due to a lack of adoption both on the domain and end-user resolver side. (Not to mention that it's a terrible protocol.)
Note that the HSTS preload list is not only used by Chrome, but practically all major browsers. For all intents and purposes it currently is the central source of truth. I imagine if the size ever becomes a problem, browsers will switch to a mechanism like Safe Browsing to distribute the list.
Earlier quoted context omitted.
It’s an old site, looks like an old site, and only recently (last 5 years or so) started running ads. It has been 15 years since the lawsuit was first filed.
It says copyright 2016 on it...
The "2016" likely means they do minor/trivial updates now and again. Maybe it'll get a "2018" in the next 6 months or so too... :)
Earlier quoted context omitted.
Worse, it's probably an emulation of a Unix mainframe running the original Cobol code - with the emulator running in machine generated JavaScript in Nodejs on AWS... (Obligatory xkcd comic: https://xkcd.com/1926/ )
No, more likely it's a newer IBM mainframe, as those are built to be backwards-compatible with software written back in the 60s.
Earlier quoted context omitted.
This is bikeshedding. The only users who would be able to distinguish the meaning of "secure" and "private" in their address bar are people who already understand what https is and isn't.
This was an honest question, really. I didn't say I had the right answer, I was wondering why they chose "Secure"
A bit side topic: It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools. It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known). I occasionally get this whe…
Probably not a good person to piss off. Several months ago I recall a website owner posted a bug to Firefox saying he didn’t need HTTPs and that Firefox shouldn’t tell users it’s insecure. Within hours his database was pwned.
Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional. The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.
He gives talks. His background is webdev and he markets himself well