A Tale of Security Gone Wrong
gavinmiller.io
A look at how the storage of entropy in your database can invalidate any password hashing scheme and compromise your users.
Read next
Refind – Worth your attention
3k
View all comments
sascha aßbachI'm missing J/K navigation :/
Inurfacesuka Дедечкаtools for curating content
Bloomberg
301
View all comments
Peter ErnstThe story comes across quite convincing but Apple, Amazon and SuperMicro say it is false. See: https://www.securityweek.com/apple-tells-congress-chinese-spy-chip-story-false
Peter ErnstAnd see this: https://www.securityweek.com/industry-reactions-chinese-spy-chips-feedback-friday
Let's Encrypt
243
View all comments
Scott WilliamsLet’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. It is a service provided by the Internet SecuritySee more Research Group (ISRG).
We give people the digital certificates they need in order to enable HTTPS (SSL/TLS) for websites, for free, in the most user-friendly way we can. We do this because we want to create a more secure and privacy-respecting Web.
The key principles behind Let’s Encrypt are:
Free: Anyone who owns a domain name can use Let’s Encrypt to obtain a trusted certificate at zero cost.
Automatic: Software running on a web server can interact with Let’s Encrypt to painlessly obtain a certificate, securely configure it for use, and automatically take care of renewal.
Secure: Let’s Encrypt will serve as a platform for advancing TLS security best practices, both on the CA side and by helping site operators properly secure their servers.
Transparent: All certificates issued or revoked will be publicly recorded and available for anyone to inspect.
Open: The automatic issuance and renewal protocol will be published as an open standard that others can adopt.
Cooperative: Much like the underlying Internet protocols themselves, Let’s Encrypt is a joint effort to benefit the community, beyond the control of any one organization.
Andrew HolmanI was researching this a bit more and found a document online that would allow us to automate this process through our Azure account. Not sure of the cost yet, but it seems straightforward enough.
‘I Forgot My PIN’: An Epic Tale of Losing $30,000 in Bitcoin
435
View all comments
Luigi CappelI felt every minute of this story. Well crafted and excruciatingly written, almost a modern day horror story but real. This must be a feat for all crypto investors
