rmhrisk

6 ms·

1.
by rmhrisk 3y ago
If a root/admin user installs a root there is no prompt, if a user does, it is scoped to the individual user profile and a prompt is displayed. No prompt as root would be meaningful because the root/admin user could just update th
2.
by rmhrisk 4y ago
With the recent GCP Cloud Certificate Manager release the global propagation time is minutes. (I should note I was a PM for this feature)
3.
by rmhrisk 4y ago
No, GCP has had arguably a superior TLS story for years. For example they do managed TLS for their workloads like AWS but they operate their own CA rather than outsourcing to Digicert for certificate issuance which gives them a better SLA.
4.
by rmhrisk 4y ago
There is no origin limitation. It works on premise or cross cloud.
5.
GammaCV is a WebGL accelerated Computer Vision library for modern web apps(gammacv.com)
3 points by rmhrisk 8y ago|0 comments
6.
by rmhrisk 9y ago
We hear you, while I can't speak to future products and features I can say we understand there is room to improve the SSL provisioning and lifecycle management story in our products and we are making investments in that area.
7.
Secondary effects of encrypting the web(unmitigatedrisk.com)
2 points by rmhrisk 9y ago|0 comments
8.
CAs and SSL and Phishing Oh My(unmitigatedrisk.com)
2 points by rmhrisk 9y ago|0 comments
9.
Do PDFs have to be so frustrating?(unmitigatedrisk.com)
1 points by rmhrisk 10y ago|0 comments
10.
E2EMail research project has left the nest(security.googleblog.com)
6 points by rmhrisk 10y ago|5 comments
11.
by rmhrisk 10y ago
That is effectively how both the Mozilla and Microsoft programs root store programs works.
12.
by rmhrisk 10y ago
Some PKI-related services can not, due to user agent behaviors and, do SSL, for example, consider OCSP; if to fetch an OCSP request you need to do an SSL connection and the library doing SSL does an OCSP check to verify the SSL cert you can
13.
by rmhrisk 10y ago
Disclosure: I am the author of that post and Product Manager for this project as well as other related work like Certificate Transparency and Key Transparency. While I can not say what Google will do in the future, I can say we are very sup
14.
by rmhrisk 10y ago
https://www.amazontrust.com
15.
by rmhrisk 10y ago
Google has announced an effort to move all CAs to Certificate Transparency, here is a Threatpost piece on the topic - https://threatpost.com/google-to-make-certificate-transparen... . They will already log their public certi
16.
by rmhrisk 10y ago
It's actually quite common, another example is Amazon who operates its own root for its SSL certificate needs. Additionally, there is minimal risk profile differences to an unconstrained subordinate CA (like GIAG2 or the equivalent Mic
17.
by rmhrisk 10y ago
There are numerous, Microsoft has its own subordinate CA that they operate for their own certificates. Amazon has its own root CA https://www.amazontrust.com/repository/ . There are more as well.
18.
by rmhrisk 10y ago
This article from TechCrunch does a good job explaining Key Transparency - https://techcrunch.com/2017/01/12/googles-key-transparency-p...
19.
by rmhrisk 10y ago
No. First, like CT you want an ecosystem of logs. Second, you have caching and in-band exchanges as means to mitigate some of that.
20.
by rmhrisk 10y ago
To understand the technical approach to the solution this is a good resource - https://github.com/google/key-transparency/blob/master/docs/... This is also useful for understanding some of the core
21.
by rmhrisk 10y ago
One of the differences between Key Transparency and other solutions is the role of certifying and logging have been separated. In other words, being in the directory does not mean the identity has been verified. The verification of control
22.
by rmhrisk 10y ago
Is this something more than a public key server? Unlike a simple public key server, this provides privacy protecting elements. The project utilizes Zero Knowlege Proofs (ZKP) to limit your access to keys associated with users you already
23.
XMLDSIG implementation in TypeScript based on WebCrypto(github.com)
2 points by rmhrisk 10y ago|0 comments
24.
WebPKI and Digital Signature Related M&A and Public Offerings(gist.github.com)
2 points by rmhrisk 10y ago|0 comments
25.
A WebCrypto Polyfill for Node in Typescript Built on PKCS#11(github.com)
2 points by rmhrisk 10y ago|0 comments
26.
XAdESjs: A Pure JavaScript Implementation of XMLDSIG and XAdES Based on WebCrypto(github.com)
3 points by rmhrisk 10y ago|0 comments
27.
by rmhrisk 11y ago
thanks, fixed everything but the quotes.
28.
by rmhrisk 11y ago
see: https://publicsuffix.org/
29.
by rmhrisk 11y ago
My post responding to this - https://unmitigatedrisk.com/?p=552
30.
by rmhrisk 11y ago
There are a bunch of good tools like https://www.ssllabs.com/ and https://mozilla.github.io/server-side-tls/ssl-config-generat... for getting your SSL configuration right. That said generating the cert

More ›