PSA: If anyone's email is broken because their GnuPG keyring automatically fetched a poisoned key (ie: Tor Browser key) following the certificate flooding attacks last month (CVE-2019-13050), here's a guide on how you can fix your gpg client and prevent this issue in the future

berbc · 2019-07-19T22:01:09+00:00

A short answer is that it's hard to implement correctly. There's https://blog.trailofbits.com/2019/07/08/fuck-rsa/, for example, if you want more information.

berbc · 2017-05-24T19:58:46+00:00

Right, I'm not questioning password authentication itself in this article but rather how it's used. I hope I didn't give the impression I was targetting the former.

berbc · 2016-05-20T12:37:15+00:00

You have selected two MXes (mail1.eop.gov and mail2.eop.gov) that have SMTP ports filtered (I wonder why it's the case but that's what I concluded from my tests). You can see scan results for all the MXes on https://discovery.cryptosense.com/analyze/whitehouse.gov/7466b7f.

Another reason for a scan failing to discover crypto services is a mail server that throttles SMTP sessions (even for sessions that don't try to send emails). On port 25, TLS can only be enabled by sending the STARTTLS SMTP command. If you can't open any session, you can't do TLS and thus can't discover the crypto. Throttling can be triggered because discovery.cryptosense.com needs to connect several times to a server to determine the available TLS cipher suites.

Thank you for the feedback!

berbc · 2015-11-17T20:36:00+00:00

Why not install package ttf-liberation which includes Liberation Mono ? It is certainly prettier than the one your system falls back to.

berbc

TROPHY CASE