• 0 Posts
  • 40 Comments
Joined 1 year ago
cake
Cake day: September 5th, 2023

help-circle

  • Opisek@lemmy.worldtoSelfhosted@lemmy.worldPaid SSL vs Letsencrypt
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    2 days ago

    OP’s security concern is valid. Different CAs may differ in the challenges used to verify you to be the domain owner. Using something that you could crack may lead to an attacker’s public key being certified instead.

    This could for example be the case with HTTPS verification (place a file with a specific content accessible through your URL) if the website has lacking input sanitization and/or creates files with the user’s input at an unfortunate location that collides with the challenge.

    This attack vector might be far-fetched, but there can certainly be differences between different signing authorities.
















  • We need an open source smart tag. I recently researched how the landscape has changed and, as an android user, still nothing good in available. I’m not sure if I remember right, but Google’s find my device was supposed to be open source or at least open spec? Might be worth looking into how easy it would be to code a lil firmware for this network myself. As much as I’d love a tag for things I cannot lose, the current options are throwing money away for no actual useful tracking (Samsung), forfeit your privacy (Tile, perhaps others), sell your soul (Apple).