Commendable but he should set an example and do something about his footer: HTTP://WYDEN.SENATE.GOV.
I got a 301 redirect to HTTPS when I tried going there.
Senator requests better https compliance at US Department of Defense [pdf]
41–50 of 56 posts
Re: Senator requests better https compliance at US Department of Defense [pdf]
#42Unrelated, but it would be nice if someone OCRed so that the text is accessible. Otherwise it's just a high-quality scan.
I was wondering something similar. It's clearly a typed letter, but it's offset from the letterhead. Was this scanned and placed onto the letterhead? I don't understand how that crookedness happens? I don't think it it wasn't a crooked page placed into a typewriter.. but I also can't explain why it would be printed, scanned at an angle, placed onto letterhead, and then published. All that said - the senator seems rea…
Lots of organizations have blank pages with a letterhead already professionally printed that you'd just print your letter/memo onto. You can even use a typewriter to type up the memo of you wanted to or even hand write it and still have the letterhead.
In this case, the page was fed through the printer crooked.
Re: Senator requests better https compliance at US Department of Defense [pdf]
#43AFAIK, the point of the DoD Root CA is to avoid trusting an external entity not to intercept military traffic. Most .mil HTTPS sites that are intended to be accessed by the public (like https://www.army.mil/ ) are signed by a regular Root CA, while internal sites use the DoD Root CA.
But any CA can issue certificates for any domain in our current system. Sure, you can always manually inspect the certificate and see if the root CA is expected. But does anyone do that at all?
Isn't that what the DNS Certification Authority Authorization (CAA) DNS record [1] is supposed to solve? Combine that with certificate transparency enforced with the `Expect-CT` header [2] and its pretty locked down. If a CA does not respect the CAA record and issues anyways, the cert will be logged to a public log. Tools like CertSpotter [3] can be setup to give notifications when certs are created. If a cert is created that should not have, then you can get an alert about it and can begin the reporting and revocation process. If a cert is created without being written to a certificate transparency log, then browsers that support `Expect-CT` header should reject it with a big error message. This works in chrome, but not yet in firefox or safari [4].
[1] https://tools.ietf.org/html/rfc6844
[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ex...
Re: Senator requests better https compliance at US Department of Defense [pdf]
#44Commendable but he should set an example and do something about his footer: HTTP://WYDEN.SENATE.GOV.
I got a 301 redirect to HTTPS when I tried going there.
Still better to link directly to the HTTPS page to prevent SSL stripping. Unless the site is already on the HSTS preload list of course; then it doesn't really matter.
Re: Senator requests better https compliance at US Department of Defense [pdf]
#45As a veteran can we please get someone to look at the patchwork of expired certificates and questionable CN's that exists as the VA Benefits system? I swear the handshakes are coming live from some old half-retired grunt in the payroll department.
What? We've got to go back to PSD? Oh, man, not again!
Re: Senator requests better https compliance at US Department of Defense [pdf]
#46Re: Senator requests better https compliance at US Department of Defense [pdf]
#47As a veteran can we please get someone to look at the patchwork of expired certificates and questionable CN's that exists as the VA Benefits system? I swear the handshakes are coming live from some old half-retired grunt in the payroll department.
That's odd - the VA pretty much leads the way with compliance on this...
It's literally the only agency listed with over 15 sites that is greater than 99% compliance.
Re: Senator requests better https compliance at US Department of Defense [pdf]
#48My team and I are the folks that have been fighting to make exactly this happen in DoD for years. We provide web hosting for the DoD Public Affairs community; we host 785 of DoD's top websites including defense.gov, af.mil, marines.mil, navy.mil, etc. For a deeper understanding of the issue, I have written a few blog posts about this to inform my stakeholders (links below).
Delivering public DoD websites using commercially-signed certificates was nearly impossible until January of this year when DoD CIO signed a memo titled, "Commercial Public Key Infrastructure (PKI) Certificates on Public-Facing Unclassified Web Servers." That memo enabled us to use commercial DV certificates to deliver public-facing .mil websites and will save the taxpayer millions of dollars. The day we got that memo was a very good day; we've been trying to get this change made for literally more than 10 years.
My team and I are passionate about our work, and we refuse to be another typical DoD information system that's down all the time, impossible to use, and only works on some archaic version of IE. The truly frustrating part of this is that we're already doing exactly what the Senator is asking, but I have no way to let him know. Yay bureaucracy.
Here are the links to the blog posts discussing this: 1 - http://publicweb.dodlive.mil/2016/10/06/why-doesnt-my-public... 2 - http://publicweb.dodlive.mil/2017/09/19/still-no-https-for-d... 3 - http://publicweb.dodlive.mil/2018/04/02/https-breakthrough/
Re: Senator requests better https compliance at US Department of Defense [pdf]
#49Earlier quoted context omitted.
But any CA can issue certificates for any domain in our current system. Sure, you can always manually inspect the certificate and see if the root CA is expected. But does anyone do that at all?
Any CA can issue certificates for any domain, but they may not be permitted to do so. Certification Authority Authorization (CAA) DNS records can be used to indicate which CA is authorized to issue certificates for a domain. The CA/Browser Forum requires all certificate authorities to check CAA records prior to issuance.
> The CA/Browser Forum requires all certificate authorities to check CAA records prior to issuance.
And what if a CA fails to check CAA records? Revoke their status as an authority? By then attackers may have already obtained highly confidential information from DoD sites.
Re: Senator requests better https compliance at US Department of Defense [pdf]
#50Earlier quoted context omitted.
I was wondering something similar. It's clearly a typed letter, but it's offset from the letterhead. Was this scanned and placed onto the letterhead? I don't understand how that crookedness happens? I don't think it it wasn't a crooked page placed into a typewriter.. but I also can't explain why it would be printed, scanned at an angle, placed onto letterhead, and then published. All that said - the senator seems rea…
I keep seeing people putting Lets Encrypt down. What is so wrong with it?
> I keep seeing people putting Lets Encrypt down.
That was not my intent at all. I use and love Lets Encrypt's service.
The comment was intended more around the fact that the US Military (and many large businesses) would never, and should never, rely on a free service like that.
Lets Encrypt is great, I love it, I'd personally use it for business - but if I'm that large, I'm going to need a support contract + binding SLA + etc with every IT vendor - Lets Encrypt doesn't do these.