… has too many hobbies.

Topic:

Security & Privacy

20 posts
Aug 2014 – Nov 2021

Embracing a ruthless approach to email spam

For years, I've dutifully clicked "Unsubscribe" from the email lists of companies I'd done business with, organizations I'd donated to, and news roundups I'd once wanted to read. Over the past two years, however, I have adopted a new strategy …

HTTPS Requests with a Small Set of Root Certificates on ESP8266 + Arduino

Part of the Getting Started with ESP8266 + Arduino series. In yesterday's post, I walked through best practices for making secure HTTPS connections using a root certificate store on ESP8266 with Arduino. In that example, I used Mozilla's full list of trusted root certificates for my certificate …

HTTPS Requests with a Root Certificate Store on ESP8266 + Arduino

Part of the Getting Started with ESP8266 + Arduino series. As part of my exploration of the basics of the ESP8266/Arduino/PlatformIO development experience, I wanted to learn how to make HTTPS requests. I figured this would be more challenging than using Golang on a Raspberry Pi, for example, because …

Securing my personal SSH infrastructure with Yubikeys

One recently-completed project I mentioned in January’s “Now” post was locking down SSH in my personal computing infrastructure using Yubikeys. In this post, I’ll outline my goals, the strategy I took, and the problems and solutions I ran into along the way.

Deploying Let’s Encrypt with Nginx on Ubuntu 16.04

This post will (tersely) walk through the steps required to deploy Let’s Encrypt for TLS, including automatic renewals, on an Ubuntu 16.04 LTS1 server running Nginx. This will allow Let’s Encrypt to fetch and renew your certificates transparently, without interfering with whatever application you may be reverse-proxying …

Takeaways from Vox’s post on malicious ads

You can pry my adblocker out of my cold, dead hands.

Reading List: Meltdown and Spectre

* Project Zero: Reading privileged memory with a side-channel * Meltdown Attack and Spectre Attack * Paper: Meltdown (PDF) * Paper: Spectre Attacks: Exploiting Speculative Execution (PDF) * ARM Whitepaper: Cache Speculation Side-channels (PDF) * Negative Result: Reading Kernel Memory From User Mode Mitigations * Paper: KASLR is Dead: Long Live KASLR (PDF) * Google: Retpoline: a software …

Recommended Equifax Breach Resources

I’ve re-typed the same advice and links a few times now for various friends, so in the interest of saving time here‘s a blog post. Quick takeaways: * Equifax's tool for checking whether you were affected has been notoriously flaky. If you’ve ever participated in the …

ALPRs in Ann Arbor

A brief overview of Ann Arbor’s current use of ALPRs.

Why Comcast injecting messages into web traffic is dangerous

Comcast’s practice of messaging customers via content injection provides a beautiful vector for successful phishing attacks.

Let’s Encrypt vs. iTunes: anatomy of an error delivering Fatal Error

iTunes appears to use Java to fetch podcast feeds, which doesn't trust the root certificate for Let’s Encrypt, the certificate authority Squarespace uses to serve sites via HTTPS.

Ad networks in their current incarnation are too dangerous to be allowed to exist.

They work fine for their intended purpose (that is, delivering mediocre advertisements and tracking you across the web), but more importantly they’re very effective at distributing malware, quickly, to _lots_ of people.

Does everything need to be HTTPS?

App Transport Security: What, Why, How?

In this talk, I answer all your questions about App Transport Security: What is it? Why does it matter? How do you make your server compatible with it, and how do you configure your app to talk to non-compliant servers? Which other apps are using ATS?