A mechanism to constrain root CAs to particular URLs/domains was proposed in firefox a while ago[0]. Perhaps an idea whose time has now come? It seems like the principle of least privilege could easily be applied to the…
Somewhat related: if there were a shared password between the client and server, Password Authenticated Key Exchange techniques [0] could offer protection even when the server CA was compromised. PAKEs use…
This feels a lot like a more production-y version of Ryoan (OSDI '16). https://www.usenix.org/conference/osdi16/technical-sessions/...
When I first saw this post, I got excited that someone had finally addressed the side channel from 17 years ago, which gathered inter-packet timing from ssh packets (and the fact that passwords are not echo'd) to a)…
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :) * : Last I checked, the two most popular Linux distros…
I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer. > How many scenarios are…
It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more…
A mechanism to constrain root CAs to particular URLs/domains was proposed in firefox a while ago[0]. Perhaps an idea whose time has now come? It seems like the principle of least privilege could easily be applied to the…
Somewhat related: if there were a shared password between the client and server, Password Authenticated Key Exchange techniques [0] could offer protection even when the server CA was compromised. PAKEs use…
This feels a lot like a more production-y version of Ryoan (OSDI '16). https://www.usenix.org/conference/osdi16/technical-sessions/...
When I first saw this post, I got excited that someone had finally addressed the side channel from 17 years ago, which gathered inter-packet timing from ssh packets (and the fact that passwords are not echo'd) to a)…
Considering GPG is the primary protection for the Linux distros that run most of the services we're discussing* , at some point our trust falls down to it anyhow :) * : Last I checked, the two most popular Linux distros…
I hope you would be correct, that lots of people would notice a compromise, though I'm not convinced that this would be the case since the attacker could pretend to be the single committer. > How many scenarios are…
It's great that DC is making their latest laws available to everyone, however it's a little scary that the commits aren't signed, meaning that anyone who gained access to the github repo could forge them (and do more…