kkl

7 ms·

1.
by kkl 5mo ago
SSH CAs are not incompatible with my argument! An SSH CA can sign short-lived certificates for just-in-time generated keys.
2.
by kkl 5mo ago
> "we can't have service accounts" To be clear: This is not my position! I advocate for service accounts in my post: > It is much harder to reason about, say, the security of an arbitrary Engineer's laptop than it
3.
by kkl 5mo ago
Part of the threat model for an Engineering team is that people come and go. They move teams which have different levels of access. They leave the organization, in most cases, on good terms. I want to set up infrastructure where I don'
4.
You don't want long-lived keys(argemma.com)
79 points by kkl 5mo ago|62 comments
5.
Anonymous credentials: an illustrated primer (Part 2)(blog.cryptographyengineering.com)
37 points by kkl 5mo ago|0 comments
6.
by kkl 6mo ago
> "Had the engineer that acted on that known better, or did other checks, this would have been avoided." <insert takes long drag tweet[1] here> I personally find "LLMs can do $THING poorly" and "LLMs can
7.
by kkl 6mo ago
> The job of a code reviewer isn't to review code. It's to figure out how to obsolete their code review comment, that whole class of comment, in all future cases, until you don't need their reviews at all anymore. Making e
8.
by kkl 6mo ago
It’s also the case that someone you trust makes an honest mistake and, for example, gets their laptop stolen and their credentials compromised. I do trust my team, and want that to be the foundation to our relationship, but I also recognize
9.
by kkl 7mo ago
Congratulations! Fish is such a wonderful shell. It’s been my daily driver for many years now but I’ve had a renewed appreciation for it now that I’m working in several different development environments. The default fish install Just Work
10.
by kkl 7mo ago
I could also buy that the free domains were ran up by scammers which could have caused some of the hair trigger Safe Browsing denylisting.
11.
by kkl 7mo ago
While there are compliance/security benefits it is not the primary motivation. If you have fairly complicated infrastructure it can be way more efficient to have a pool of ready to go beefy EC2 instances on a recent commit of your mult
12.
Go's filepath.Clean does not prevent path traversal(argemma.com)
2 points by kkl 8mo ago|0 comments
13.
String comparison timing attacks in Go(kel.bz)
1 points by kkl 9mo ago|0 comments
14.
Confessions to a Data Lake(confer.to)
37 points by kkl 9mo ago|13 comments
15.
Control planes are a useful concept(kel.bz)
2 points by kkl 9mo ago|1 comments
16.
Authenticated Dictionaries with Skip Lists and Commutative Hashing(kel.bz)
3 points by kkl 7y ago|0 comments
17.
RSA-Based Key Encapsulation Mechanisms(kel.bz)
1 points by kkl 7y ago|0 comments
18.
Building lattice reduction (LLL) intuition(kel.bz)
81 points by kkl 9y ago|7 comments
19.
The Goldreich–Goldwasser–Halevi (GGH) Cryptosystem(kel.bz)
2 points by kkl 9y ago|0 comments
20.
by kkl 10y ago
Losing control of your actual phone is not the same as losing control of your phone number. I'm not sure about Microsoft, but Google supports several other 2FA mechanisms in addition to SMS.
21.
by kkl 10y ago
I think this is true of "Second Wave" black metal bands but less true of more recent output.
22.
by kkl 10y ago
What properties does email have that asynchronous messaging services (e.g. Signal) do not?
23.
by kkl 10y ago
Signal does have a desktop application. I believe you can also register a Signal account using a phone number from a service like Twilio. I'm not 100% sure that will work with Signal desktop though. https://whispersystems.
24.
by kkl 10y ago
Most interesting e2e projects have abandoned email, specifically SMTP, as a secure messaging platform. I would look outside SMTP-based solutions if I were to start using a different project (assuming doing so is an option... I hope it is!).
25.
by kkl 10y ago
Praetorian | Security Engineer | Austin, Texas | REMOTE (For principal and staff positions) Praetorian is different. We are a collective of highly-technical engineers focused on helping our clients solve their most difficult security proble
26.
by kkl 10y ago
I think a password manager (minus some of the scary bits like browser plugins) is a much better option than a mental password generation scheme. Maybe some folks can handle this but I think this is a non-ideal general recommendation.
27.
Some challenges in post-quantum standardization(blog.cr.yp.to)
3 points by kkl 10y ago|0 comments
28.
by kkl 10y ago
That is called a "cipher cascade"[1] and practically speaking, no. [1] https://en.wikipedia.org/wiki/Multiple_encryption
29.
by kkl 10y ago
This is a common theme in this thread but I'll re-state it here: Web browsers cannot reliably distinguish between a configuration mistake and an attack. For this reason, I think hard HPKP fails are a good thing. For those who opt-in to
30.
by kkl 10y ago
It depends on who you ask, but I personally don't think hard certificate validation failures are a bad thing.

More ›