I've talked a lot about revocation checking before on my blog and made various arguments against it and explained why it's not such a great idea, but there's nothing like demonstrating something. I decided to do a little experiment and show just how easy it is for an attacker to…
Yesterday it was announced that Let's Encrypt are to revoke a large number of certificates after identifying a bug in their CA software, Boulder. This blog is here to keep a record of details related to this event and help those affected. What happenedLet's Encrypt found a bug in their…
I've talked a lot about revocation in recent years and the issues with the current methods for checking the revocation status of a certificate are well understood and widely documented. We may now have something that changes that, let's take a look at CRLite! We'll start with a few pieces…
I've relied on a lot of different projects over the years that have helped me in various different ways and recently had the opportunity to start giving something back. Running Report URIWe're lucky enough to have Michal Špaček with us on the team at Report URI and it was him…
It's finally happening! We've had 2 failed attempts through the CA/B Forum and now Apple has decided to enforce a maximum lifetime of 398 days on certificates issued from 1st Sep 2020. Previous attempts to reduce to 1 yearThe 2 previous attempts to reduce certificate lifetimes to 1 year…
There has been a huge focus on encryption on the web recently, with lots of that centred around HTTP with things like HTTPS and HSTS. Now we're taking the same concept and extending it to email with MTA-STS, or Mail Transfer Agent Strict Transport Security. MTA-STSYou can read about MTA-STS…
With TLS having taken some great steps forwards in recent years, with TLSv1.2 in 2008 and TLSv1.3 in 2018, it's time to start dropping support for the legacy versions of TLS. Legacy TLSTLSv1.0 was released in 1999, that's more than 20 years ago(!), and TLSv1.1 was…
It's been an interesting ride over the last few years but HPKP, or HTTP Public Key Pinning, is finally coming to the end of its tenure. With support now gone in the last remaining browser, HPKP has been consigned to the scrap heap. HPKPI first wrote about HPKP back in…
Chrome has certainly been one of the main contributors towards the recent push to HTTPS online and without their contribution, I do find myself wondering how much progress would have been made. The Chrome team have just announced two more big changes coming soon and they will help push the…
Yes, it's that time of year again and the last 6+ months have flown by. Time for a look at the state of security in the Top 1 Million sites on the web! Here are the results, updates, trends and analysis for the progress we've made over the last 6…
