Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Submission + - Mozilla to Support Key Pinning in Firefox 32

Trailrunner7 writes: Mozilla is planning to add support for public-key pinning in its Firefox browser in an upcoming version. In version 32, which would be the next stable version of the browser, Firefox will have key pins for a long list of sites, including many of Mozilla’s own sites, all of the sites pinned in Google Chrome and several Twitter sites.

Public-key pinning has emerged as an important defense against a variety of attacks, especially man-in-the-middle attacks and the issuance of fraudulent certificates. In the last few years Google, Mozilla and other organizations have discovered several cases of attackers using fraudulent certificates for high-value sites, including Gmail. The function essentially ties a public key, or set of keys, issued by known-good certificate authorities to a given domain. So if a user’s browser encounters a site that’s presenting a certificate that isn’t included in the set of pinned public keys for that domain, it will then reject the connection. The idea is to prevent attackers from using fake certificates in order to intercept secure traffic between a user and the target site.

The first pinset will include all of the sites in the Chromium pinset used by Chrome, along with Mozilla sites and high-value sites such as Facebook. Later versions will add pins for Twitter, a long list of Google domains, Tor, Dropbox and other major sites.

Submission + - Twitch streamer SWATted while broadcasting live. (arstechnica.com)

halfEvilTech writes: Police in Littleton, Colorado are investigating a prank call on Thursday that led a SWAT team to raid an online video gamer's office. Heavily armed officers forced a well-known gamer to the ground in what is believed to be a case of "swatting" by an unknown rival gamer.

"I think we're getting swatted," Jordan Mathewson, who was playing Counter-Strike, said during his Twitch livestream. "What in the world?"

full video of the raid is also available at the source

Comment Re:Main Confusion Stems From Vocabulary? (Score 1) 122

Generally bricked means the device cannot be recovered using a normal end-user procedure. Needs JTAG to recover (especially if you must solder the connection in) ==bricked. Needs to be turned on while holding volume up key == not bricked (wedged hard). Needs reset button or power cycle to recover == wedged. No procedure can recover it == dead.

Comment Re: I like... (Score 1) 643

You haven't been reading the news if you don't realize that cops have been beating innocents, lying in court, claiming peaceful protesters are violent, and other such violations of rights that won't be so easy to get away with if the cop has to wear a camera.

Comment Re:What's the point? (Score 1) 511

I could as easily pick apart your arguments. I find it hard to imagine never using code that is shared with other projects for example. Why re-invent the wheel? Are you declaring code re-use dead? What about the system libraries? Do you hack those without notice too?

And what happened to unit testing where you should easily enough shake out cases where people called a function they shouldn't have?

I have argued that the programmer who just takes the IDE's word for it will eventually end up in deep trouble.

You seem to be arguing that duck typing is bad because shoddy practices rule.

Slashdot Top Deals

All power corrupts, but we need electricity.

Working...