ivlad

9 ms·

1.
by ivlad 9d ago
Minority of sites have global traffic. This is especially true for non-English sites. So, while average request may have to travel quarter (not half) of the Internet globe, median request from the set of requests that matter has much lower
2.
by ivlad 9d ago
nginx can do about 20krps per CPU for static files. You only need CDN if you want to improve time to DOM loaded in locations where time to first byte is over ~100ms and can be improved with local caching. If all your users are in Spain and
3.
by ivlad 10d ago
> PKCS11 doesn't allow you to attest that the key is resident in the PKCS11 provider, which as you say, the author alludes to, but doesn't cover. You don’t need that if you include quote in CSR and then CA validates the quote a
4.
by ivlad 10d ago
I might be missing something: is this any conceptually different from using PKCS11 provider for TPM in OpenSSL? Also, with real TPM, the key could be locked to a specific configuration register value, which makes less sense for VMs. “Quote”
5.
by ivlad 2mo ago
If someone eats junk food at McDonald’s it does not mean I should eat junk food at Burger King. If someone does not encrypt their radio comms, it does not mean I should be satisfied with breakable encryption.
6.
by ivlad 2mo ago
Absolutely
7.
by ivlad 2mo ago
The whole post is a PR activity presented as some kind of analysis. It is bs. First, long-living credentials are the standard because the machinery to rotate them is complicated and, in fact, via indirection requires another set of long-liv
8.
by ivlad 2mo ago
Lack of the authentication means an adversary can feed any data to the receiver. Local data access is a win, I agree
9.
by ivlad 2mo ago
09 F9 !!
10.
by ivlad 2mo ago
44 bits of security is not “pretty good”. The post author used Python, but anything more performant would result almost real-time decryption. There are no performance implications of using a proper 128 key because they are doing AES anyway.
11.
by ivlad 2mo ago
Technically, no. SPF allows to say “these IPs are authorised to send emails as example.com”, where DMARC allows to say “I as domain owner recommend to quarantine emails that fail SPF and DKIM”, it also allows finer alignment (ie, matching b
12.
by ivlad 2mo ago
Three so-called “cribs” are typically mentioned in literature: 1. Weather reports that were encrypted with Enigma for the High Command and then sent again encrypted with a much weaker cipher for (if I recall correctly) merchant fleet. 2. “K
13.
by ivlad 2mo ago
Mandatory watch: https://www.youtube.com/watch?v=pyMNIFZTQkg
14.
by ivlad 2mo ago
I have deployed FIDO authenticators at a ~2000 employees organization as the second factor. It was great for a while - when early versions of macOS and iOS respected the “platform” claim and created non-exportable private keys backed by Sec
15.
by ivlad 2mo ago
Neither Apple nor Google do key attestation for their cloud-synced keys. This > Which is happening with all the big platforms right now. Does not seem to be happening. Am I missing something?
16.
by ivlad 2mo ago
If you are going to store passkeys in a password manager, the whole situation is no more secure than just using passwords. Consider: 1. Password managers tie passwords to sites, so phishing-resistance is achieved. 2. Password managers allow
17.
by ivlad 2mo ago
I was talking about the non-resident FIDO keys. “Passkey” term is meaningless unfortunately because FIDO Alliance did not define it initially, it was a marketing term invented by Apple and then re-introduced (or shoved down the throat) by t
18.
by ivlad 2mo ago
> The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud). From what I know, Apple ignores `platform` and `ResidentKeyRequirement` claims a
19.
by ivlad 2mo ago
> Not true. The original concept was always for them to be cloud synced. It was not. The original U2F spec was created before that idea was around and it talked about hardware security keys as means to store the primary key pair.
20.
by ivlad 2mo ago
I think in Apple stack they cannot be made hardware bound anymore. Platform claim is ignored on creation and the keypair is always in Keychain and syncable unless iCloud sync is disabled.
21.
by ivlad 2mo ago
You don’t. You don’t store anything at all. On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or hardware. The encrypted blob is sent to the server and stored
22.
by ivlad 2mo ago
Or, you use `xargs -0` for null termination instead of white space termination. `find` conveniently supports `-print0` that will use null character as separator.
23.
by ivlad 2mo ago
Was exactly my thought: why not to use null termination? Looks like a case where reading man page would have spared writing another copycat utility.
24.
by ivlad 2mo ago
TP-Link is absolute crap of network hardware. Not to mention “leftover debug code”: https://nvd.nist.gov/vuln/detail/CVE-2024-21827
25.
by ivlad 2mo ago
Genuine question, if you use bastion hosts, why do you need Tailscale? Why not to expose tcp/22 to the internet and allow public key authentication only (or, certificate based one, if you prefer fancy)? OpenSSH security track record se
26.
by ivlad 2mo ago
Rolex and Casio deal with simply when IERS introduces one. Beats is a new time measurement system, not just a new clock. So if the world (IERS) would stops it, they would have to have new rules for dealing with leap “micro-days” or “mili-be
27.
by ivlad 2mo ago
Enterprise PKI is not hard and has many uses besides issuing certificates to web servers. Any company of 1000+ users or endpoints should just set one up. I did it multiple times, most recently using YubiHSM as root key store for offline ent
28.
by ivlad 2mo ago
Or, just use IPv6 and host Internet services in a routable address. Then, use ACLs at web server / proxy / L7 lb level to allow acme-challenge unauthenticated but everything else authenticated. Lets encrypt supports IPv6 for valid
29.
by ivlad 2mo ago
It looks like a poorly thought-out marketing project. For example, how to deal with the Earth rotation irregularity and leap seconds? One beat is way too long to correct with, so the correction has to be in centibeats, fractions of beat, in
30.
by ivlad 2mo ago
Native Apple Maps allow downloading map regions for offline use.

More ›