576 reputation
310
bio website rushyo.com
location United Kingdom
age 28
visits member for 4 years, 4 months
seen Apr 29 at 11:15

Apr
13
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
Cloudflare have the capacity to completely automatically generate certs against a Comodo intermediary. That intermediary is not Cloudflare exclusive, it's one of Comodo's larger intermediates. You can see this by looking at the cert chain on almost any Cloudflare site.
Apr
10
revised TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Highlighting the answer bit of my rant
Apr
10
revised TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
(Your) Cert Fries, MF!
Apr
10
revised TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Errata on silliness of requirements
Apr
10
revised TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Added IMO, since this actually subjective
Apr
10
answered TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
Apr
10
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
I feel this is a good case demonstrating why the theory of the current PKI trust mode doesn't function in the real world (wide web), and should therefore be replaced with superior alternatives insofar as is practical. Which is exactly what this question is querying, how practical is this alternative? I suspect the answer is 'not very', but it's still a legitimate enquiry.
Apr
10
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
But hey, one of the few nice things about a certificate-based model is, if you really want, you can just stop trusting the root. Feel free to delete Comodo's roots (who supply Cloudflare's certificates) from all your systems if that's your assessment. Maybe losing a good chunk of the WWW works for you and your use cases. But I heartily disagree that such a control would be the outcome of an measured assessment of the associated risks/benefits for the majority of end-users.
Apr
10
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
By the definition you are working to, you cannot trust Cloudflare sites (objectively, because of this). You cannot trust most CDNs. You cannot trust most government sites. You cannot trust most enterprises. That is not a working, practical, engineering definition to apply to working, practical, engineering trust/risk decisions.
Apr
10
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
That is not what often happens in the wild. Most enterprises and CDNs simply do not provide full trust across their WANs. For a public example, look at Google, who only addressed this because of the NSA leaks. The theoretical definition on what you would prefer to trust is not the actual choice you, as a user making trust decisions, has to make. You also have to deal with incomplete information and the need to make practical risk decisions. Practicality and theory are not in sync in this context.
Apr
9
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
"then people can simply reject" I invite you to 'simply' reject GeoTrust (who Cloudflare use) and Google's CA (since Google do this with their load-balancing) and almost every government CA (who also do this with their load-balancing) and then continue using the web. People need to accept that public CAs are not an optimal model and, in practice, you can't just ignore alternatives on the grounds of "works as designed" unless you accept you will end up distrusting basically the entire WWW for one reason or another.
Apr
9
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
+1. All the little padlock tells you is your communication with the server you are sending the data to is secure. People would be surprised to learn quite how often it's immediately decrypted before being sent to the server that actually consumes it, typically by a load balancer, or that load balancer uses TLS but then internally all the sysadmins are using their own self-signed certs.
Mar
20
comment How would one crack a weak but unknown encryption protocol?
@TerryChia A principle can be applied successfully 100% of the time and still doesn't become a fact. A fact isn't actionable, like a principle is. You can enact a principle by following it, you can't enact a fact. You don't say "We need to apply the laws of gravity for this". You do say "We need to apply Kerckhoff's principle for this". Someone can choose to ignore Kerckhoff's principle (at their peril). They can't choose to ignore the laws of gravity.
Mar
20
comment How would one crack a weak but unknown encryption protocol?
@SmitJohnth For it to be a rule it would need an obligation. You can apply a rule to a principle (i.e. everyone must follows Kerckhoff's principle to work on this library) but that doesn't make the principle itself a rule.
Mar
18
comment How would one crack a weak but unknown encryption protocol?
It's a principle. It's meant to guide decision making. It's not a law, rule or theory that is actually fact.
Mar
18
comment How would one crack a weak but unknown encryption protocol?
Worse than nothing because it breeds a false sense of security. At least if you don't have a control in place you continue to rationalise future security decisions on that assumption, rather than relying upon the assumption that you have a control in place that is better than it really is.
Mar
4
comment Automatic robot crawler to check web pages authenticity?
+1 for Tripwire, although it's worth noting that managing a Tripwire instance can easily consume a lot of your time.
Mar
4
comment How dangerous is game guard?
@ruief Not meaning to sound snippy but if that were true then we might as well get rid of UAC, SU, ACLs, User Groups...
Mar
1
awarded  Good Answer
Feb
28
comment I managed to capture a botnet control host, what do I do with it?
@Shadur If you really think the data you can collect is that valuable (I suspect it's not) then then you may wish to try something like Volatility to record the current forensic state of your RAM at least. The trouble is that if you screw it up you can end up doing more harm than good.