It feels like yesterday, but haxpo2015ams was already six months ago!
Session materials index:
Index of /materials/haxpo2015ams
![[ICO]](https://wiert.me/wp-content/uploads/2015/10/blank.gif)
![[PARENTDIR]](https://wiert.me/wp-content/uploads/2015/10/back.gif)
![[ ]](https://wiert.me/wp-content/uploads/2015/10/layout.gif)
–jeroen
Archive for the ‘https’ Category
Index of /materials/haxpo2015ams
Posted by jpluimers on 2015/11/27
Posted in *nix, *nix-tools, Encryption, Hashing, https, LifeHacker, OpenSSL, PKI, Power User, Public Key Cryptography, Security, Signing | Leave a Comment »
StartSSL indeed offers free Class1 certificates for any subdomain
Posted by jpluimers on 2015/11/20
StartSSL does in fact offer free SSL certs for subdomains, though they are Class 1 certificates.
It works: just start the process for the domain, then when you get to the step for entering a subdomain, enter any one (of course www works, but you can do the process multiple times so register certificates for multiple subdomains).
–jeroen
via: tls – Free second-level domain SSL certificate – Information Security Stack Exchange
Share this:
Posted in *nix, *nix-tools, Apache2, https, Power User, Security | Leave a Comment »
HTTPS Everywhere Firefox/Chrome/Opera extension – Electronic Frontier Foundation
Posted by jpluimers on 2015/09/11
Over time this has become a must have: HTTPS Everywhere | Electronic Frontier Foundation developed by EFF and TOR.
Too bad many sites still do not work correctly with it.
This is especially true for places or networks where HTTP (or even worse HTTPS) is going through a MitM layer, for instance many mobile providers do this by injecting tracking bits to your traffic:
- SSL all the things, all the time Greedy provider MITMs all traffic, adding user identifier to HTTP headersadding….
- How Verizon’s Advertising Header Works | Web Policy.
–jeroen
via: HTTPS Everywhere | Electronic Frontier Foundation.
Share this:
Posted in https, Power User, Security | Leave a Comment »
Hacking Team had more and more need for SSL MITM
Posted by jpluimers on 2015/07/07
Interesting reads:
- https://ht.transparencytoolkit.org/rcs-dev%5cshare/HOME/Naga/httpX/Presentation.pptx
- Hacking Team Breach Shows a Global Spying Firm Run Amok | WIRED.
- “Hacking Team Transparency Report” could sign Windows Kernel Drivers.
–jeroen
Share this:
Posted in Communications Development, Development, https, Internet protocol suite, LifeHacker, Power User, Security, TCP, TLS | Leave a Comment »
Time to upgrade: SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates.
Posted by jpluimers on 2015/06/01
They days of SHA-1 are quickly coming to an end. Chrome has already marked SHA-1 signed TLS/SSL certificates for having an expiration > 2015-12-31 as insecure for a few weeks now. They promised to sunset SHA-1 about 9 months ago.
So if you haven’t done so, upgrade your HTTPS (and HTTP/2 which defaults to TLS) certificates to SHA-2. A great site of help here is SHAAAAAAAAAAAAA | Check your site for weak SHA-1 certificates. It is open source at GitHub.
You’ve less than 6 months now.
More in dept-reading (especially the comments by Ryan Sleevi): Chrome 42 (next stable) will mark SHA-1 signed certs with a validation date >2015 as insecure!.
–jeroen
PS: if you really need to do the balancing act, you technically can serve old certificates to SHA-2 incompatible clients while serving more secure certificates to modern clients. But it’s a risk, so you might as well tell these old clients they’re out.
Share this:
Posted in https, Power User, Public Key Cryptography, Security, TLS | Leave a Comment »
HTTPS blessing and curse: Security Collapse in the HTTPS Market – ACM Queue
Posted by jpluimers on 2014/09/29
Funny to discover these two articles today:
–jeroen
Share this:
Posted in https, Power User, Security | Leave a Comment »
The Wiert Corner - irregular stream of stuff 