361–370 of 419 posts
Earlier quoted context omitted.
Your shared hosting service doesn't need to support Let's Encrypt, it just needs to allow you to upload a certificate. You can use https://gethttpsforfree.com/ to generate it.
They want an "installation" fee. And then how does the renew process work?
Earlier quoted context omitted.
Until users stop using the same password everywhere, your aquarium website is effectively the security for all your users accounts, including their bank.
How is that the websites fault?
Earlier quoted context omitted.
"insecure", "huge red flag." For a banking site, an e-commerce site, a webmail, sure. Must an aquarium enthusiast forum be resistant to Man-in-the-Middle attacks? What about weak ciphers? Should every site be resistant to offline decryption by a state actor?
Yes, every site should be. The average user shares their niche acquarium site login username/password with their gmail login and bank and everything else. In the physical universe we occupy a given user's most security-sensitive site is exactly as vulnerable as their least security-conscious site. It behooves us as professionals to take that fact seriously.
So what? Not every site has a login, or stores details about users. What about sites that are purely informational? If a site doesn't have passwords, why are you worried about users re-using passwords?
Earlier quoted context omitted.
Your shared hosting service doesn't need to support Let's Encrypt, it just needs to allow you to upload a certificate. You can use https://gethttpsforfree.com/ to generate it.
They want an "installation" fee. And then how does the renew process work?
Firefox has started to do this recently and it's been fantastically informative and helpful. It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.
Firefox has started to do this recently "Note that is warning in the url bar is only in Firefox Nightly and Firefox Developer Edition. This has not been released to Firefox Beta and Firefox Release."[0] So this is not a security feature that most end users can rely on, yet. [0] - https://developer.mozilla.org/en-US/docs/Web/Security/Insecu...
I use DE, so I have been seeing these for a little while, but I think even in the stable channel you can toggle the security.insecure_password.ui.enabled param to true in about:config.
1: https://developer.mozilla.org/en-US/docs/Web/Security/Insecu...
Earlier quoted context omitted.
google competes with the likes verizon, comcast and at&t, and the data google gathers on you is very valuable. why would they want to share that data with the line operators for free? sorry to say, but https is not an altruistic move by google.
This is ascribing an absurd level of Machiavellian intent to Google. Why can't people just accept that occasionally, Google engineers do stuff that isn't profitable to the parent company?
If privacy improves that will benefit the internet (privacy has real costs that don't involve state actors like hackers, etc). Many people, especially in developing countries, are afraid of transactions over the internet and use cash on delivery.
What should be done for routers and printers that are accessed by their IP address?
Well, they are insecure.
Modems are anyways way more insecure due to the default password being admin or 123456, etc. And many are accessible from the public internet.
I think my modem got hacked due to that (I saw some login attempts a little before the DNS got changed causing Youtube to stop working).
Earlier quoted context omitted.
As with most things, progress isn't clean or easy. Shifts in policy or practice cause disruptions, and then people adjust. The world is a dynamic place. Software is no exception. SSL libraries will get better if they get used more. The developers will make them better. Or if they can't, we'll find a solution that works. The question is whether the benefit of the disruption outweighs the cost. Browser-makers decided t…
> SSL libraries will get better if they get used more. The developers will make them better. Or if they can't, we'll find a solution that works. I keep hearing this, but failing to see it. Since OpenSSL's inception.