Things and Stuff Wiki - an organically evolving knowledge base personal wiki with a totally on-the-fly taxonomy containing topic outlines, descriptions and breadcrumbs, with links to sites, systems, software, manuals, organisations, people, articles, guides, slides, papers, books, comments, screencasts, webcasts, scratchpads and more. use the Table of Contents for navigation on longer pages. see About for further information. / et / em
- 1 General
- 2 Passwords
- 3 Proxy
- 4 Server
- 5 TLS/SSL
- 5.1 Specs
- 5.2 Guides
- 5.3 Software
- 5.4 HTTPS
- 5.5 Certificates
- 5.6 CAs
- 5.7 PFS
- 5.8 CRL
- 5.9 DNSSEC
- 5.10 DANE
- 5.11 HPKP
- 5.12 Future
- 5.13 Other
- 6 Vulnerabilities
- 7 Cookies
- 8 Virus
- 9 Web
- 10 Testing
- 11 Wi-fi
- 12 Disk cleanup
- 13 Hardware
- 14 Legal
- 15 UX
- 16 Other
- http://chargen.matasano.com/chargen/2009/7/22/if-youre-typing-the-letters-a-e-s-into-your-code-youre-doing.html 
- EZCrypt - We provide you with the power to encrypt the data BEFORE it gets stored on our site. All encryption/decryption is done on the client end using AES-CBC 128bit with a hash key generated on each paste. The server will only store the encrypted data without the hash key, so only you have the power to decrypt it.
- More Encryption Is Not the Solution 
- cryptosphere - Encrypted peer-to-peer web application platform for decentralized, privacy-preserving applications
- http://tobtu.com/decryptocat.php - don't use cryptocat
- Gitian is a secure source-control oriented software distribution method. This means you can download trusted binaries that are verified by multiple builders.
- http://astalavista.box.sk/ - old skool ish
- http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html 
- http://www.keepassx.org - what I use
See also Distros
- haveged project is an attempt to provide an easy-to-use, unpredictable random number generator based upon an adaptation of the HAVEGE algorithm. Haveged was created to remedy low-entropy conditions in the Linux random device that can occur under some workloads, especially on headless servers. Current development of haveged is directed towards improving overall reliablity and adaptability while minimizing the barriers to using haveged for other tasks.
- http://blog.configserver.com/ - software update news
csf -r # restart CSF csf -d 18.104.22.168 # quick deny an ip csf -d 22.214.171.124/24 # deny access from an ip range csf -dr xxx.xxx.xxx.xxx # remove from the deny list csf -a xxx.xxx.xxx.xxx # quick allow / whitelist an ip (bypass auto blocking) csf -ar xxx.xxx.xxx.xxx # remove ip from whitelist
See also *nix#Permissions
- http://www.portknocking.org/ - info site
- https://en.wikipedia.org/wiki/Port_knocking - a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received, the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specific port(s). A variant called single packet authorization exists, where only a single "knock" is needed, consisting of an encrypted packet. The primary purpose of port knocking is to prevent an attacker from scanning a system for potentially exploitable services by doing a port scan, because unless the attacker sends the correct knock sequence, the protected ports will appear closed.
See also HTTP#SSL
- Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the Internet. They use asymmetric cryptography for authentication of key exchange, symmetric encryption for confidentiality and message authentication codes for message integrity. Several versions of the protocols are in widespread use in applications such as web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP).
In the TCP/IP model view, TLS and SSL encrypt the data of network connections at a lower sublayer of its application layer. In OSI model equivalences, TLS/SSL is initialized at layer 5 (the session layer) then works at layer 6 (the presentation layer): first the session layer has a handshake using an asymmetric cipher in order to establish cipher settings and a shared key for that session; then the presentation layer encrypts the rest of the communication using a symmetric cipher and that session key. In both models, TLS and SSL work on behalf of the underlying transport layer, whose segments carry encrypted data.
- YouTube: DEFCON 19: SSL And The Future Of Authenticity - Moxie Marlinspike, 2011
- http://tools.ietf.org/html/rfc2712 - Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)
- http://tools.ietf.org/html/rfc4279 - Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)
- http://tools.ietf.org/html/rfc5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
- http://tools.ietf.org/html/rfc6091 - Using OpenPGP Keys for Transport Layer Security (TLS) Authentication
- http://tools.ietf.org/html/rfc6125 - Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
- https://briansmith.org/browser-ciphersuites-01.html 
- SSL/TLS Deployment Best Practices - tutorial whitepaper
- OWASP Top 10 for .NET developers part 9: Insufficient Transport Layer Protection - Touching on HTTPS, SSL and TLS
- https://daniel.molkentin.net/2014/04/21/fighting-cargo-cult-the-incomplete-ssltls-bookmark-collection/ 
- DEFCON 19: SSL And The Future Of Authenticity - Moxie Marlinspike
- https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html 
openssl ciphers -v
openssl verify -CAfile /etc/nginx/ca.pem certs/client.crt
- PolarSSL makes it trivially easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) products, facilitating this functionality with a minimal coding footprint.
- https://www.tbray.org/ongoing/When/201x/2012/12/02/HTTPS - basic intro
- Living with HTTPS (19 Jul 2012)
- Improved HTTPS Performance with Early SSL Termination
- https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security - force HTTPS
- http://blog.nvisium.com/2014/04/is-your-site-hsts-enabled.html 
- SSL Server Test - This free online service performs a deep analysis of the configuration of any SSL web server on the public Internet.
- sslScanner - Scan SSL based TCP services, ips, ports and network ranges to obtain certificate expiry data. Get automated alerts about certificates expiring
- SSL Converter - convert SSL certificates to and from different formats such as pem, der, p7b, and pfx
- Certificate Depot - Create your self-signed SSL certificate instantly and for free.
See also HTTP#SSL
- SSL Certificate Types and Purposes
- http://en.wikipedia.org/wiki/Server_Name_Indication - SNI allows more than one domain per ip address, not supported by older IE and Android 2
Certificate signing request
- .csr This is a Certificate Signing Request. Some applications can generate these for submission to certificate-authorities. It includes some/all of the key details of the requested certificate such as subject, organization, state, whatnot, as well as the public key of the certificate to get signed. These get signed by the CA and a certificate is returned. The returned certificate is the public certificate, which itself can be in a couple of formats.
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
- .pem Defined in RFC's 1421 through 1424, this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates. The name is from Privacy Enhanced Email, a failed method for secure email but the container format it used lives on.
- .key This is a PEM formatted file containing just the private-key of a specific certificate. In Apache installs, this frequently resides in /etc/ssl/private. The rights on this directory and the certificates is very important, and some programs will refuse to load these certificates if they are set wrong.
- .pkcs12 .pfx .p12 Originally defined by RSA in the Public-Key Cryptography Standards, the "12" variant was enhanced by Microsoft. This is a passworded container format that contains both public and private certificate pairs. Unlike .pem files, this container is fully encrypted. Every time I get one I have to google to remember the openssl-fu required to break it into .key and .pem files.
- SF: What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?
- DER vs. CRT vs. CER vs. PEM Certificates and How To Convert Them
- http://en.wikipedia.org/wiki/Subject_Alternative_Name - allows multiple domains, but not like a wildcard
involving better/slower background checks for the Organisation Name field
- http://en.wikipedia.org/wiki/Extended_Validation_Certificate - provides a green address bar, bit of a rip-off though
Vulnerable to MITM as cracker can generate their own, OK if you control both ends.
- How to Create A Self Signed Certificate - sslshopper.com
- How to create a self-signed SSL Certificate which can be used for testing purposes or internal usage
Lets Encrypt / ACME
./letsencrypt-auto certonly -d example.com -d www.example.com --agree-tos --renew-by-default -a webroot --webroot-path=/tmp/letsencrypt-auto
- http://www.comodo.com/ - security history a bit of a joke
- http://ssl.comodo.com/wildcard-ssl-certificates.php - from £224.95
- HN discussion: $50 comodo wildcard SSLs (while they last)
- http://www.verisign.com/ - owned by Symantec
- http://en.wikipedia.org/wiki/GlobalSign - owned by GMO CLOUD K.K. in Japan
- http://www.vpsnodebox.com/ssl-certificates - AlphaSSL - GlobalSign certificate.
- http://en.wikipedia.org/wiki/StartCom - based in Israel, provides StartSSL certs. hostile customer service.
Free certs, one cert per domain, 1 year. One only pays for acions that require human intervention, i.e., validation.
- https://pierrekim.github.io/blog/2016-02-16-why-i-stopped-using-startssl-because-of-qihoo-360.html 
Community group providing certs. Web of trust based assurance point system. Not carried by major browsers, just Linux distros.
- http://lolroot.ca/ - lol
- SSLMate - Buy SSL certs from the command line.
- CertSimple - The fastest way to prove your company's identity online. EV Certificates are £149 a year. Multiple servers from £249 a year for 3 server names.
- TACK, a proposal for a dynamically activated public key pinning framework that provides a layer of indirection away from Certificate Authorities, but is fully backwards compatible with existing CA certificates, and doesn't require sites to modify their existing certificate chains.
- https://en.wikipedia.org/wiki/Vulnerability_(computing) - a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.
- YouTube: Using c99 shell hacking
- Postcards from the post-XSS world - Michal Zalewski
- https://www.owasp.org/index.php/Main_Page Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks.
- w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.
- sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
- Inception is a FireWire physical memory manipulation and hacking tool exploiting IEEE 1394 SBP-2 DMA. The tool can unlock (any password accepted) and escalate privileges to Administrator/root on almost any powered on machine you have physical access to. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe interfaces.
- https://en.wikipedia.org/wiki/Security_token - sometimes a hardware token, authentication token, USB token, cryptographic token, software token, virtual token, or key fob) may be a physical device that an authorized user of computer services is given to ease authentication. The term may also refer to software tokens.
Security tokens are used to prove one's identity electronically (as in the case of a customer trying to access their bank account). The token is used in addition to or in place of a password to prove that the customer is who they claim to be. The token acts like an electronic key to access something.
Some may store cryptographic keys, such as a digital signature, or biometric data, such as fingerprint minutiae. Some designs feature tamper resistant packaging, while others may include small keypads to allow entry of a PIN or a simple button to start a generating routine with some display capability to show a generated key number. Special designs include a USB connector, RFID functions or Bluetooth wireless interface to enable transfer of a generated key number sequence to a client system.
- https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-218446368 - not open source anymore?
- https://en.wikipedia.org/wiki/Nitrokey - an open source USB key to enable secure encryption and signing of data. The secret keys are always stored inside the Nitrokey which protects against malware (such as computer viruses) and attackers. A user-chosen PIN and a tamper-proof smart card protect the Nitrokey in case of loss and theft. The hardware and software of Nitrokey are available as open source, free software and open hardware which enables independent parties to verify the security of the device. Nitrokey is supported on Microsoft Windows, Linux, and Mac OS X.
- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis - Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away. Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.
- http://safeharbor.export.gov/list.aspx - UK DPA safe harbours