1
Against DNSSEC
10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 93 posts.
2
3
Secure Secure Shell
No ads, no tracking. Ever.<br/> <strong>blog.stribik.technology</strong> is completely static, without cookies or javascript.<br/> <strong>comments.stribik.technology</strong> uses javascript and local storage, it's loaded when you click
4
Why ninety-day lifetimes for certificates?
This is a historic blog post at this point. Please see our certificate lifetime documentation for the current status of certificate lifetimes. We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer…
5
6
Signify: Securing OpenBSD from Us to You
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
7
The CA's Role in Fighting Phishing and Malware
Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them. Deciding what to do here…
8
Fighting spam with Haskell
Visit the post for more.
9
From kafkatrap to honeytrap
The short version is: if you are any kind of open-source leader or senior figure who is male, do not be alone with any female, ever, at a technical conference. Try to avoid even being alone , ever, because there is a chance that a “women in tech” advocacy group is going to try to collect your scalp.
10
How To Create an SSH CA to Validate Hosts and Clients with Ubuntu
When dealing with an extensive infrastructure and many team members, managing SSH keys for authentication can become unwieldy. However, SSH can utilize cert…
11
If you've nothing to hide, you've got nothing to fear
Since 1851 Amsterdam had a registry that recorded the following innocent pieces of data about the residents: Name, Date of birth, Address, Marital Status, Parents, Profession, Religion, Previous Addresses and Date of Death if deceased. For many years this system served well and was kept meticulously up to date.
12
Deprecating Non-Secure HTTP
Today we are announcing our intent to phase out non-secure HTTP. There's pretty broad agreement that HTTPS is the way forward for the web. In recent months, there have been ...
13
Saying goodbye to encrypted SMS/MMS
It’s 2015, and the end of the road for encrypted SMS/MMS in TextSecure. The TextSecure story started back in 2009, at the dawn of the smartphone era. Back then, TextSecure focused on securing the transport that everyone coming from feature phones was familiar with: SMS. Today, many things have c...
14
15
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
16
China's Great Cannon
This post describes our analysis of an attack tool that we identify as separate from, but co-located with, the Great Firewall of China.
17
Signal Desktop
Today we’re making the Signal Desktop beta available. Signal Desktop brings the trusted private messaging experience of Signal to the desktop, with a simplicity that allows you to seamlessly continue conversations back and forth between your mobile device and your desktop computer.
18
LastPass Security Notice
error
19
Firefox exploit found in the wild
Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded ...
20
Keybase's New Key Model
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
21
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
22
23
24
25
Hidden backdoor API to root privileges in Apple OS X
TL;DR The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It’s been there for several years (at least since 2011), I found it in October 2014 and it can be exploite…
26
Do not let your CDN betray you: Use Subresource Integrity
Mozilla Firefox Developer Edition 43 and other modern browsers help websites to control third-party JavaScript loads and prevent unexpected or malicious modifications. Using a new specification called Subresource Integrity, a ...
27
28
State Considered Harmful – A Proposal for a Stateless Laptop
Two months ago I have published a detailed survey of varioussecurity-related problems plaguing the Intel x86 platforms. While the picturepainted in the paper...
29
Intel x86 considered harmful – survey of attacks against x86 over last 10 years
Back in summer I have read a new bookpublished by one of the core Intel architects about the Management Engine (ME).I didn’t quite like what I read there. In...
30
Google Deceptively Tracks Students’ Internet Browsing, EFF Says in FTC Complaint
San Francisco—The Electronic Frontier Foundation (EFF) filed a complaint today with the Federal Trade Commission (FTC) against Google for collecting and data mining school children’s personal information, including their Internet searches—a practice EFF uncovered while researching its “Spying on...