Tag Archives: privacy

GitHub 明年關閉 SSH 上 SHA1 相關的 Kx (Key Exchange) 演算法

GitHub 定下落日條款了:「Weak cryptographic standards deprecation update」。 這次目標是 diffie-hellman-group1-sha1 與 diffie-hellman-group14-sha1,同時啟用了 diffie-hellman-group-exchange-sha256: Since the announcement, we have been focusing on the impact of disabling the diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 key exchanges for SSH. As of last week, we have enabled diffie-hellman-group-exchange-sha256. This … Continue reading

Posted in Computer, Murmuring, Network, Programming, Security, Service | Tagged , , , , , , , , , | Leave a comment

Google Chrome 將 .dev 設為 HSTS Preload 名單

其實是兩件事情... 第一件是 Google Chrome 把 .dev 結尾的網域設為 HSTS Preload 名單:「Chrome to force .dev domains to HTTPS via preloaded HSTS」。 第二件事情是隨著第一件來的,HSTS Preload 必須由 domain 擁有人提出啊... 所以 .dev 是合法的 TLD (gTLD)? 文章作者給了答案,是的,而且就是 Google 擁有的: Wait, there's a legit .dev gTLD? Yes, unfortunately. … Continue reading

Posted in Computer, DNS, Murmuring, Network, Programming, Security, Service, WWW | Tagged , , , , , , , , , , , , , , , , | Leave a comment

Imgur 上 HTTPS

Imgur 宣佈 HTTPS 化:「HTTPS on Imgur」。 Today, we deployed HTTPS by default on Imgur. All traffic is now redirected to https:// and, as of now, HTTPS is the default on all Imgur URLs. 總算是上線了... 先前是靠 HTTPS Everywhere 做。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, WWW | Tagged , , , , , , , | Leave a comment

Google 放棄對海外伺服器搜索票的抵抗了...

先前美國政府透過搜索票,要求各雲端廠商提供海外伺服器的資料而引起話題 (像是先前 Microsoft 往上打官司抵抗:「Does US have right to data on overseas servers? We’re about to find out」),而現在看起來 Google 打算放棄掙扎了:「Google stops challenging most US warrants for data on overseas servers」。 Google has quietly stopped challenging most search warrants from US judges … Continue reading

Posted in AWS, Cloud, Computer, GCP, Murmuring, Network, Privacy, Security | Tagged , , , , , , , , , , | Leave a comment

VPN 的評價

文章的作者試了很多家 VPN 服務,然後文章的標題有點長,有種輕小說的感覺...:「I tested the most recommended VPN providers using my credit card to find the best ones — and which ones you should avoid.」。 不過這種文章有很多東西很主觀,大家心裡有個底就是了... 作者比較滿意的是 TunnelBear 與 OVPN 這兩家,也許等手上 PIA 到期的時候再試看看要怎麼選好了,畢竟 PIA 還是目前最便宜的方案。

Posted in Computer, Murmuring, Network, Privacy, Security, Service, VPN | Tagged , , , , , , , , , , , , , | Leave a comment

Telegram 使用 CDN 加速下載

Telegram 說明他們將會使用 CDN 加速:「More Speed and Security!」。 資料在 CDN 的節點上是加密的,金鑰需要透過 Telegram 的 key server 提供: While these caching nodes are only used to temporarily store public media (imagine Telegram versions of superpopular YouTube hits), all data that goes through them … Continue reading

Posted in CDN, Computer, Murmuring, Network, Privacy, Security, Service, Software, WWW | Tagged , , , , , , , , , , , , , | 1 Comment

對 Open Data 的攻擊手段

前陣子看到的「Membership Inference Attacks against Machine Learning Models」,裡面試著做到的攻擊手法: [G]iven a data record and black-box access to a model, determine if the record was in the model's training dataset. 也就是拿到一組 Open Data 的存取權限,然後發展一套方法判斷某筆資料是否在裡面。而驗證攻擊的手法當然就是直接攻擊看效果: We empirically evaluate our inference techniques on classification models … Continue reading

Posted in Computer, Murmuring, Privacy, Programming, Search Engine, Security | Tagged , , , , , , , , , , | 1 Comment

Amazon Route 53 將會加緊支援 DNS CAA

看到 Amazon Route 53 要支援 DNS CAA 的消息:「Announcement: Announcement: CAA Record Support Coming Soon」。 裡面有提到 CA/Browser Forum 的決議,要求各瀏覽器支援 DNS CAA: On March 8, 2017, the Certification Authority and Browser Forum (CA/Browser Forum) mandated that by September 8, 2017, CA’s are … Continue reading

Posted in AWS, Cloud, Computer, DNS, Murmuring, Network, Security | Tagged , , , , , , , , , , , , , | Leave a comment

Google Chrome 對 WoSign 與 StartCom 的白名單要完全移除了

在 Twitter 上看到的: Chrome will fully distrust WoSign and StartCom in Chrome 61; beta in July, stable in September. https://t.co/5fnda6aUQw — Ivan Ristic (@ivanristic) July 7, 2017 對 WoSign 與 StartCom 的移除會發生在 61 版,而依照「Final removal of trust in WoSign and … Continue reading

Posted in Browser, Computer, GoogleChrome, Murmuring, Network, Security, Service, Software, WWW | Tagged , , , , , , , , , , , | 1 Comment

Let's Encrypt 決定要規劃 Wildcard SSL Certificate 了

Let's Encrypt 把時間表喊出來了,預定在 2018 年年初開放使用:「Wildcard Certificates Coming January 2018」。 Wildcard SSL Certificate 會需要走新的 ACME v2 協定認證: Wildcard certificates will be offered free of charge via our upcoming ACME v2 API endpoint. We will initially only support base domain validation via … Continue reading

Posted in Computer, Murmuring, Network, Privacy, Security, Service | Tagged , , , , , , , , , , , , | Leave a comment