bifurcation

5 ms·

1.
by bifurcation 9mo ago
Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industry (including some major refactors!). Instead of press
2.
by bifurcation 9mo ago
Heh, as I was saying about shorter lifetimes encouraging automation... https://news.ycombinator.com/item?id=46210786
3.
by bifurcation 9mo ago
Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter poi
4.
Why I Voted to Sell .org(circleid.com)
3 points by bifurcation 7y ago|1 comments
5.
by bifurcation 10y ago
The idea here is to be lighter-weight than profiles, or the similar feature in Chrome. I've got three different containers going right now, side-by-side in one browser window. In addition to the per-tab basis, providing separation wi
6.
by bifurcation 10y ago
Actually, it's in Beta now, and will be shipping to Firefox release channel users on Monday or Tuesday.
7.
Communicating the Dangers of Non-Secure HTTP(blog.mozilla.org)
9 points by bifurcation 10y ago|0 comments
8.
by bifurcation 10y ago
It's a mix. Some patches are just getting rebased and landed. For others, the Firefox and Tor Browser teams are working together to re-implement the feature in a way that makes more sense in the broader Firefox architecture. For exam
9.
by bifurcation 10y ago
Fingerprinting (in general) is the next thing on the agenda after First Party Isolation. Addressing canvas fingerprinting is in the plan: https://wiki.mozilla.org/Security/Fingerprinting https://bugzilla.mo
10.
by bifurcation 11y ago
In a word, yes. When a server uses a Let's Encrypt certificate, a browser will consider it as issued under an IdenTrust root CA, which the browser trusts. So it will consider the Let's Encrypt certificate trusted.
11.
by bifurcation 11y ago
Other things I use all the time: `openssl x509 -in $FILE -text | less` https://lapo.it/asn1js https://golang.org/pkg/crypto/x509/ https://github.com/agl/certificatetransp
12.
by bifurcation 11y ago
Yep, that should work fine. You'll just need to do the validation process for each domain.
13.
by bifurcation 11y ago
Unfortunately, ECDSA support is not as universal as RSA. But I understand that the plan is to start working on ECDSA support pretty much as soon as the first root is stood up, so it shouldn't be long after the start.
14.
by bifurcation 11y ago
You've got things a little confused here. Let's Encrypt doesn't need to be part of the CABF in order to be included in the browsers, but they do need to demonstrate that they abide by the rules that CABF defines (the Baselin
15.
by bifurcation 11y ago
The CA/Browser Forum Baseline Requirements require that the CA have you sign one: "Prior to the issuance of a Certificate, the CA SHALL obtain ... either: 1. The Applicant’s agreement to the Subscriber Agreement with the CA, or 2.
16.
by bifurcation 11y ago
openssl req -new -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem openssl s_server -accept 8000 -key key.pem -cert cert.pem -HTTP
17.
by bifurcation 11y ago
The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.
18.
by bifurcation 11y ago
Hey, this is Richard, the author of the post. All the feedback here is great, but if you've got thoughts on whether we should pursue this strategy or not, please comment on the mozilla.dev.platform list. https://lists.mozil
19.
by bifurcation 11y ago
The Mozilla root program currently has a similar plan proposed, with a final decision pending in the next day or so. https://groups.google.com/forum/#!topic/mozilla.dev.security...
20.
by bifurcation 12y ago
That's correct. Also, if you've got an A/AAAA record for the domain name in question, you could run an ACME client on that box that spins up a temporary web server. That's what the node-acme demo client does. https:&#
21.
by bifurcation 12y ago
> I don't know what the story is with that site Turns out they had the wrong certificate chain provisioned. Seems to be fixed now.
22.
by bifurcation 12y ago
Yes, we plan to apply a few mitigations of this type. Part of the idea of the "Proof of Possession of a Prior Key" challenge is so that if a web server requests a cert for a domain with an existing certificate, we can ask them to
23.
by bifurcation 12y ago
See also: https://sendto.mozilla.org/
24.
by bifurcation 12y ago
We're working on an FAQ. This thread has been really helpful in clarifying which Qs are FA :) With regard to your questions: > Will it provide wildcard certs? Not initially, but possibly in a future iteration. Note that having an a
25.
by bifurcation 12y ago
Getting to short-lived certificates is a goal, but the reality for now is that OCSP and CRLs are what implementations require, and what the CABF Baseline Requirements require. So we'll need to start with those.
26.
by bifurcation 12y ago
The ultimate vision is to make it even easier than that -- you set the "turn on HTTPS" option, and the platform auto-configures HTTPS with a certificate and appropriate ciphers. That will require upgrades to apache, nginx, IIS, e