jcase

11 yıl öncediscuss

Thanks. You're right. Now I'm just wondering what IdenTrust gains from free DV certificates.

11 yıl öncediscuss

Acceptance into Mozillaʼs CA Certificate Program is usually discussed in public. Let's encrypt is not on the list of pending CA applications[0]. Does anyone know if they are introducing a new root certificate or teaming up with an existing CA?

[0] https://wiki.mozilla.org/CA:PendingCAs

jcase

11 yıl öncediscuss

Running the openssl s_client command from the article will show you live.

jcase

12 yıl öncediscuss

When you mentioned discourse serving 19k req/sec, does it hit the ruby stack at all? If no, serving 19k req/sec of cached HTML doesn't seem that impressive. What am I missing?

jcase

12 yıl öncediscuss

You're (almost) describing certificate pinning. Have a look at http://tack.io although it appears down for the moment. Here is the HN thread: https://news.ycombinator.com/item?id=4010711

jcase

12 yıl öncediscuss

With SSH you usually own both endpoints (or at least trusting your cloud provider).

The example you give with regards to exchanging a piece of paper is very similar. It's ridiculously hard to do such a thing on large scale without trusting intermediaries.

I'm putting my eggs on certificate pinning.

jcase

12 yıl öncediscuss

This article[0] is largely about DNSSEC and DANE but it might give you some insights why making registrars the sole authorities isn't such a good idea.

[0] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

jcase

13 yıl öncediscuss

Well, whatever the license, here is to a bright future! That a rising tide may lift all boats.

jcase

13 yıl öncediscuss

I'm not sure this is true (anymore?). There are many open source projects who are thriving under non copyleft licenses.

If someone wanted to be a dick about it they could release modified GPL code as one big diff and publish it on some obscure webpage only their customers have access to. Instead we see more and more companies and individuals becoming friendly open source citizens. Perhaps some because the GPL mandates it but I would like to think mainly because they feel it's right thing to do—copyleft or not.

jcase

13 yıl öncediscuss

Not sure if you mean for profit and proprietary or just making money in general. For some reason though a lot of people think you can't sell GPL'd software which you absolutely can.

jcase

13 yıl öncediscuss

DANE isn't without its own problems. Moxie Marlinspike wrote an excellent blog post about it.

http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

jcase

13 yıl öncediscuss

If users can't configure their Facebook privacy settings I'm not too optimistic about their ability to manage root certificate trust bits. It's a good start though.

Ideally OS/Browser vendors would drop compromised CAs. That happened with DigiNotar. It's not always an option though — the three largest CAs have a 83.97%[0] market share. Dropping any one of them breaks the internet.

Unfortunately a lot of people seem hell bent on destroying rather than improving on top of it.

[0] https://ssl.netcraft.com/ssl-sample-report/CMatch/certs

jcase

13 yıl öncediscuss

Sounds very similar to Convergence. In fact, it turns out that "Convergence is based on previous work from the Perspectives Project at Carnegie Mellon University".[0] I don't think this (or Convergence) will see widespread adoption though. For now, public key pinning (e.g. Tack.io) seems like the best way forward.

For what it's worth, many CA's are trying to raise the bar by way of the CA/Browser Forum.[1] The public mailing list is quite interesting at times.

[0] https://en.wikipedia.org/wiki/Convergence_(SSL)#Background

[1] https://www.cabforum.org

jcase

13 yıl öncediscuss

Same version, no warning. Edit: Oops, had yet to read that it's now temporarily whitelisted by google.

jcase

13 yıl öncediscuss

Interesting, thanks!

jcase

13 yıl öncediscuss

When the EU region was announced[1] last month they weren't Safe Harbor compliant (yet). Has that changed?

[1] https://blog.heroku.com/archives/2013/4/24/europe-region (near the bottom).

jcase

13 yıl öncediscuss

For some reason it reminded me of "The Electronic Money Mill". Original site is gone but The Internet Archive has a copy: http://web.archive.org/web/20080412233535/http://www.msen.co...

Fun (semi-fictional) read about Electronic Funds Transfer, crypto and the FBI.

jcase

13 yıl öncediscuss

The Luna SA they are using doesn't come cheap. For an H/A setup with all the extras (backup tools, service contract) I was quoted ~$80k.

jcase

13 yıl öncediscuss

Automatic failover is a pretty big feature though. I wish Postgres had a built-in solution. Sure, I could use Pacemaker but it's no where near as painless.

jcase

13 yıl öncediscuss

It's 72 actually. I thought it was 56 as mentioned on the original [?] BCrypt website[1]. A thread[2] on security/stackexchange discusses a workaround for the 72 char limit. See https://gist.github.com/4690368 for a simple test case that shows the >72 char truncation.

The source provides a hint:

    /* Schneier specifies a maximum key length of 56 bytes.
    * This ensures that every key bit affects every cipher
    * bit.  However, the subkeys can hold up to 72 bytes.
    * Warning: For normal blowfish encryption only 56 bytes
    * of the key affect all cipherbits.
    */

[1] http://bcrypt.sourceforge.net/

[2] http://security.stackexchange.com/questions/21524/bcrypts-72...

Submissions

NewsgroupDirect Security Breach

AWS CloudHSM: Secure Key Storage and Cryptographic Operations

comments