konklone

5 ms·

1.
by konklone 15d ago
Ah, that is too bad. It's certainly always possible the countries list could expand in future, but it's not something I have insight into and unfortunately can't give you too much to go on.
2.
by konklone 15d ago
Wikimedia Foundation | Lead Product Manager, Security | REMOTE (US + 18 countries) | Full-time I lead the security and safety team for Wikipedia, at the Wikimedia Foundation. I’m hiring a product manager to lead our security roadmap and ste
3.
by konklone 2y ago
On isitchristmas.com, this happens for several days surrounding Christmas. The defined use case is informing you of whether it is Christmas.
4.
by konklone 5y ago
The document distinguishes between enterprise-facing and public-facing systems. For enterprise-facing (government employees, contractors, etc.), it's talking about discontinuing use of TOTP. For public-facing systems, it doesn't i
5.
by konklone 5y ago
Login.gov does support identity verification. Not all uses of Login.gov require it, so many accounts are just used for email with MFA.
6.
by konklone 6y ago
Author of the post here :) In those 5 years, HTTPS has gone from being the minority of traffic to being ~90% of the connections observed by most Chrome clients (scroll down a few graphs for the Chrome-observed one): https://trans
7.
by konklone 7y ago
There's not federalism within states in a legal sense the way there is between states and the feds, but cities value their independence too and prefer to have their own infrastructure. I would expect the city, rather than the state, to
8.
Enhance Email and Web Security – Binding Operational Directive 18-01(cyber.dhs.gov)
11 points by konklone 9y ago|2 comments
9.
by konklone 9y ago
CLAs are frowned upon by some, but they don't completely kill contribution from 3rd parties. I've signed plenty, and I've encountered plenty of projects that use them that continue to have a good community of outside unaffili
10.
by konklone 9y ago
I wouldn't use the word "illegal" - it's a directive of OMB (the White House's management and budget office), not a law or a regulation or an executive order. The only true enforcers are OMB themselves. But to answe
11.
by konklone 9y ago
The policy is still in effect, and its supporting home page is here: https://https.cio.gov
12.
by konklone 9y ago
Cloud Foundry doesn't have a problem injecting headers, as HTTP traffic is plaintext inside the system itself. It's once it starts traveling across the public internet that encryption is needed. This does make it harder for networ
13.
by konklone 10y ago
Just so it's clear, NSA is technically part of DoD. (Though it's a bit like FBI's relation to DOJ, they operate very independently.) Also, the DoD CIO has had, since ~2003, this excellent FAQ supporting open source: http:&#x
14.
by konklone 10y ago
I'm from 18F, and I'm now a "contributor", but only because they accepted my pull requests. :)
15.
by konklone 10y ago
In fact, there are now way more state/local .gov domains (~4,000) than federal .gov domains (~1,300).
16.
by konklone 10y ago
Exactly.
17.
by konklone 10y ago
What you're trusting the browser for there is the extra protection that preloading provides, but that's not the whole benefit here. The larger benefit is that it makes it infeasible for services to neglect to support HTTPS. So, ev
18.
by konklone 10y ago
Very true. HPKP is not part of this change, and if you look at GSA's guidance on HPKP, it's cognizant of this risk: https://https.cio.gov/certificates/#http-public-key-pinning
19.
by konklone 10y ago
Yes, I do know that hostnames are typically outside the HTTPS envelope. However, user-agent is not, and would be exposed (and could then possibly be correlated to other HTTPS traffic from the same IP address). Also, potentially cookies from
20.
by konklone 10y ago
@prodtorok - This is one of the nice things about HSTS. The includeSubDomains directive can create automatic client enforcement for all subdomains. If some component of an agency ignores this and doesn't configure HTTPS, they'll f
21.
by konklone 10y ago
To quote my comment from above - bear in mind that when it comes to plain HTTP, it's not just the system's confidentiality and integrity that you need to weigh against availability: it's the user's confidentiality an
22.
by konklone 10y ago
I wouldn't say this is reinventing the CA system. You don't need to trust any particular browser here. The effect is that web services must offer a secure HTTPS connection, using the existing CA system (or an enterprise CA, if the
23.
by konklone 10y ago
Bear in mind that when it comes to plain HTTP, it's not just the system's confidentiality and integrity that you need to weigh: it's the user's confidentiality and integrity. That's a larger moral responsibility
24.
by konklone 10y ago
Not quite either one -- it's technical enforcement by the TLD, but still done on a per-domain basis (this doesn't affect state/local .gov domains, or legislative/judicial .gov domains). The dotgov.gov program will forcib
25.
by konklone 10y ago
Let's Encrypt isn't specifically mentioned in the post, though the post hits the underlying point: > GSA provides extensive guidance to agencies on HTTPS deployment at https.cio.gov, and encourages .gov domain owners to obtain
26.
by konklone 10y ago
Subdomains generally get automatically included when a second-level domain is preloaded. So, for .gov domains that fall under scope here, their subdomains will all have HTTPS enforced by modern web browsers. Web browsers enforce preloading
27.
by konklone 10y ago
Second level domains. There are waayyyyy more subdomains, as you note. You can see some information and estimates on this here: https://18f.gsa.gov/2017/01/04/tracking-the-us-governments-p... We (18F, me) per
28.
by konklone 10y ago
If there's an issue with certificate validation, the attack surface is already open.
29.
by konklone 10y ago
DoD does have some .gov domains, so it would affect them in that way. But .mil is not affected.
30.
by konklone 10y ago
IPv6 is a federal mandate for agencies: https://www.whitehouse.gov/sites/default/files/omb/assets/eg... And NIST has a dashboard of adoption: https://usgv6-deploymon.antd.nist.gov/cg

More ›