• 0 Posts
  • 198 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle










  • What exactly are you trusting a cert provider with and what are the security implications?

    End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.

    What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

    You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.

    Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.

    In what way could it benefit security and/or privacy to utilize a paid service?

    For most use cases, as far as I know, it doesn’t.

    LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?

    LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.

    Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.



  • Cool, didn’t know that about Ecosia.

    Qwant: looks like maybe they used to have a browser that might have been forked from Firefox, but it hasn’t been updated in a while - per the App Store listings, I think they now just have a lightweight search engine frontend.

    Brave on iOS appears to have been forked from Firefox on iOS back in 2018-2019, which was news to me. (“Appears to” regards the date; it was definitely forked from Firefox).

    the rest of the browser is derived from Firefox

    This might be true for some, like Ecosia, but I’m guessing that Brave isn’t pulling changes from Firefox. It seems like they basically used the Firefox codebase as a starting point - and in 5 years of development, a lot can change.

    I wasn’t saying that this is generally true for IOS browsers, just that a pretty large part of FOSS ones are

    Gotcha, that makes more sense.

    One more thing to point out is that your comment reads like they were based on Firefox and that Firefox didn’t use Webkit (but of course Firefox on iOS also uses Webkit).

    more like Floorp

    Meaning that they’re forks of Chromium on desktop in the same way Floorp is a fork of Firefox on desktop?


  • They are based off Firefox for IOS which uses WebKit, but they are still based on the browser like Edge which is based on chromium vs Flakon which uses blink but not the rest chromium

    I’ve reread this like 5 times and still have no clue what you’re trying to say.

    The person you replied to was technically incorrect - other browsers aren’t UIs on top of Safari, but (outside the EU) they’re all limited to the same browser rendering engine Safari uses, Webkit.

    This means that other rendering engines - namely Firefox’s Gecko and Chromium’s Blink, as well as niche engines like Ladybird’s - are unavailable there (outside the EU).

    They are based off Firefox for IOS

    This is not generally true of browsers on iOS, and might not be true of any.

    Flakon

    I didn’t know what this was at first - apparently this was a typo for “Falkon.”

    which uses blink

    The browser rendering engine used by Chromium browsers is Blink, which was forked from Webkit over a decade ago, but I’m not aware of any non-Chromium browsers that use it… including Falkon, which appears to leverage QtWebEngine, which itself uses Chromium.

    but they are still based on the browser like Edge

    By “based on” do you mean “uses the same branding as and is loosely inspired by?” Because I highly doubt that the iOS codebase is based off the desktop codebase for many Chromium or Firefox-based browsers… they may share some code and assets but I doubt they get to share much more than that.


  • It’s a bit unclear what you mean by “Apple” - I’m assuming you mean Safari on both Mac and iOS.

    The search engine I use is SearxNg. On Firefox on Mac it was pretty easy to add.

    To use it in Safari, I installed the Keyword Search extension from the App Store. It has the option to set a search engine as the default if you don’t use a keyword, so I did that. This works in both Mac and on iOS / iPadOS.

    There are other Safari extensions that do similar things, like Customize Search Engine (free). Kagi has an extension that can make Kagi the default search engine, for example (it doesn’t appear that there’s an equivalent for Startpage, though). I haven’t used anything other than Keyword Search for this, though.


  • The purpose of slang is to signal group identity.

    That’s a purpose of slang, not its only purpose.

    Slang can also be more efficient (“cringe” is one syllable; “cringe-worthy” is three) and it contributes to the evolution of language, leading some terms - like “cringe” to become more mainstream and to see use outside of the group that popularized them.

    Besides, Gen Z might have come up with “cringe,” but millennials were practicing nounification, verbification, and adjectification when Gen Z was still learning to talk, and that’s all “cringe” as an adjective is.

    to my ear, calling something “cringe” sounds like something kids say, because mostly in my everyday life, I only hear children saying it like it made up a fair chunk of their entire vocabulary.

    The oldest Gen Z-ers are 27 and the youngest are 12, so almost none of them are “kids” anymore - they’re teens and adults. But there’s also a difference between using slang on the internet and in in-person contexts, particularly more formal ones. Slang that’s common in one group might not be in another group in the same age range, even if they’re geographically similar. But even so, I’ve heard millennials use (and over-use) “cringe” in public and in private.

    When a GenXer or old Millennial use it, it can come across as either affected or immature.

    A 6 year old in 1994 would have been born in 1988, which is right in the middle of the millennial range (1981-1996), meaning they wouldn’t be an “old Millennial.” But even if they were born in ‘81, my opinion wouldn’t change. Focusing too much on who “should” use a term like “cringe,” especially online, isn’t at all productive, and isn’t very different from telling someone they’re not a big enough fan to wear a t-shirt or to cosplay as a character they think is cool. They’re both just gatekeeping, plain and simple.




  • It sounds like your bank is doing MFA (multi-factor authentication) correctly, and that’s a good thing, because it sure would be obnoxious to have to verify all that information just to view your balances, and it’s a higher risk activity to allow someone to transfer funds than to view your balances.

    If the dealership didn’t verify your identity and someone else made changes to your lease, would you have a problem with that?

    You don’t have to use an authenticator on your phone. You can use a password manager like Bitwarden (their $10/year premium plan, or their $40/year family plan) that supports saving TOTP and auto-filling them from a browser extension (click to copy or you can have it automatically copied to the clipboard after you auto-fill the password). It also supports passkeys and you can avoid getting locked into a single ecosystem that way.