Quick phishing demo. Would you fall for something like this?pic.twitter.com/phONMKHBle
-
Show this thread
-
Replying to @musalbas @SwiftOnSecurity
That's pretty damned good. I hate to be a stick in the mud about this, but if it weren't for free certs, this attack would likely fail bc 1) browsers warn about creds on http sites and 2) only option for attacker would be to buy a cert or self-sign This is cost of free certs.
5 replies 0 retweets 45 likes -
Replying to @frontier_anon @jeffwilsontech and
Let's encrypt has improved the encryption side of TLS incrementally while decimating the (arguably more critical) trust component. I hate it.
6 replies 4 retweets 24 likes -
Replying to @blaktron @jeffwilsontech and
I also recognize its value in getting quick, error free encryption. But I do think it has destroyed the trust model the CA industry did pretty well for a while (except you, Symantec)
2 replies 0 retweets 21 likes -
A++++ would read/like/share/rt this tweet again We're now seeing supply-side attacks on software & repositories & spoofing/phishing domain attacks like this due in part to our heavy focus on encryption at the expense of the other elements of x509 PKI.
2 replies 0 retweets 12 likes -
Replying to @frontier_anon @jeffwilsontech and
You guys are deluded if you think paid certificates were any harder to get. CAs were doing the exact same DV validation Let's Encrypt is. You think paying a few bucks for a DV cert was stopping phishers? Ha, no.
1 reply 0 retweets 0 likes
You can argue that we could use having other stronger validation models emphasized, but the fact of the matter is DV was *already* the bulk of certs issued by CAs, and Let's Encrypt didn't change that in any way. "Free certs are bad for security" is CA FUD.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.