Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @Scott_Helme

Scott Helme

@Scott_Helme

16 Nov

@BritishGasHelp

@BritishGasHelp @srobertson92 A few things to help you out from your friendly British security researcher:

1) Shorter passwords are easier to remember which is what makes them weak and easy to guess. This means it's more likely someone else will have access to it, not less likely.

@BritishGasHelp

@BritishGasHelp @srobertson92 2) Allowing someone to have an easy to remember 8-10 character password doesn't mean you need to prevent someone else from having an ultra-secure 64 character password. It's possible for both of these things to coexist, and they should.

@BritishGasHelp

@BritishGasHelp @srobertson92 3) Weak passwords do not protect customer data, they do the opposite and put customer data at risk. We should be encouraging stronger passwords and the use of password managers.

Read 7 tweets

Scott Helme

@Scott_Helme

2 Sep

https://twitter.com/Scott_Helme/status/1300813526030839808

I'm not sure what's more worrying, that CAs have continued to issue certificates for >398 days or that I'm not surprised that it's happened... 🤷‍♂️

https://twitter.com/Scott_Helme/status/1300813526030839808

Imagine buying a new certificate that looks like this!
NET::ERR_CERT_VALIDITY_TOO_LONG

Here's the certificate, they definitely missed the deadline:
Validity
Not Before: Sep 1 00:16:16 2020 GMT
Not After : Sep 1 00:16:16 2022 GMT

crt.sh/?id=3318010380

Read 9 tweets

Scott Helme

@Scott_Helme

16 Apr

@ubnt

The @ubnt fairy came and I couldn’t be more excited! 😝

So here we go with the build! First up was the rack, I wanted one with wheels because of where it’s going (space restricted and can’t go on the wall). Couldn’t see one I like with wheels so I gave mine wheels!

Next was unboxing and damn Ubiquiti know how to package stuff. It’s like opening Apple products but better. I mean just look at how they package *screws*!!

Read 24 tweets

Scott Helme

@Scott_Helme

3 Mar

Let's Encrypt identified a bug in their CAA checking and disabled issuance for 2h 12m whilst they patched: community.letsencrypt.org/t/2020-02-29-c…

As a result of this, Let's Encrypt will be revoking quite a large number of certificates: community.letsencrypt.org/t/revoking-cer…

The total number is 3,048,289 and you can download the list of serial numbers that will be affected here: letsencrypt.org/caaproblem/

Read 30 tweets

Scott Helme

@Scott_Helme

16 Aug 19

As entertaining as the whole EV thing is in some respects, I do sit back and question my own knowledge and views in the background too. A very common thing that keeps coming up in defence of EV, is phishing. I did some reading and here are a few interesting things.

Every piece of data I've looked at so far, including PhishLabs and the APWG, show that phishing is on the rise and it's a massive problem. I believe and hope that everyone will agree with that, but there are interesting stats around phishing on HTTPS.

Look at this Netcraft data on certificate issuance to phishing sites, that's quite a remarkable trend and indicates a shift of phishing sites moving from HTTP to HTTPS.
source: news.netcraft.com/archives/2017/…

Read 19 tweets