231–240 of 290 posts
Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!
Because it allows to you to work for six days, and rest on the seventh. Like God did.
Why 6 day and not 8? - 8 is a lucky number and a power of 2 - 8 lets me refresh weekly and have a fixed day of the week to check whether there was some API 429 timeout - 6 is the value of every digit in the number of the beast - I just don't like 6!
Do I understand correctly: would someone have a concrete example of URL which is both an IP address and HTTPS, widely accessible from global internet? e.g. https:// / ?
Earlier quoted context omitted.
Cloud providers could check the transparency lists, and if there’s a valid cert for the IP, quarantine it until the cert expires. Problem solved.
That's leaving money on the table, unless they continue to charge the previous tenant for the duration of quarantine.
Earlier quoted context omitted.
>which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. So no one that actually has to renew these certificates. Hey! How long does a root certificate from a certificate authority last? 10 to 25 years? Why don't those last 120 minutes? They're responsible for the "security" of the whole internet aren't they?
It's almost like the threat models for CA and leaf certs are different.
Earlier quoted context omitted.
The popular HTTP validation method has the same drawback whether using DNS or IP certificates? Namely, if you can compromise routes to hijack traffic, you can also hijack the validation requests. Right?
Yes, there have been cases where this has happened ( https://notes.valdikss.org.ru/jabber.ru-mitm/ ), but it's really now into the realm of 1) How to secure routing information: some says RPKI, some argues that's not enough and are experimenting with something like SCION ( https://docs.scion.org/en/latest/ ) 2) Principal-Agent problem: jabber.ru's hijack relied on (presumably) Hetzner being forced to do it by German…
Part of the issue with RPKI is its taking time to fully deploy. Not as glacial as IPv6 but slower than it should be.
If there was 100% coverage then RPKI would have a good effect.
Earlier quoted context omitted.
> I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication There's also this little thing called DNS over TLS and DNS over HTTPS that you might have heard of ? ;)
I don't quite understand how this relates?
Erm ? Do I have to spell out that I was pointing out that there was more than the "ephemeral services" that were being guessed at that could take advantage of IP certs ?
Earlier quoted context omitted.
They can just do id verification instead of domain, either in-house or outsource it. app store review isn't what I was talking about, I meant not having to verify your identity with the appstore, and use your own signing cert which can be used between platforms. Moreover, it would be less costly to develop signed windows apps. It costs several hundred dollars today.
Azure has a service ('Artifact Signing') which is $10/month for signing Windows executables (not Windows Store apps, which don't need it.) That's pretty reasonable, considering it is built in to all the major code signing tools on Windows, they perform the identity verification, and the private keys are fully managed by Azure. Code signing certs are required to be on HSMs, so you're most likely going to be paying som…
I owe you one @briHass :)
Earlier quoted context omitted.
Then it would be a grave error to issue an IP cert without active insight into BGP. (Or it doesn't matter which chain you have.. But calling a website from a sampling of locations can't be a more correct answer.)
>it would be a grave error to issue an IP cert without active insight into BGP Why? Even regular certs are handed out via IP address.
They retire challenges that were once acceptable. What happens if they require a real chain of trust? They retire http and domain names keep working on DNS/DNSSEC.
Making IP with only http challenges is going backwards.