|
Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: Nyaaan on May 20, 2012, 07:50:42 AM It has been compromised in the past, so it likely will again in the future. You should simply just not use StartCom, especially after you've been hacked yourself. StartCom should have been completely blacklisted in browsers. Comodo, USER-TRUST, and even Verisign have also been compromised in the past, and there's no chance that they'll be removed from browsers because they're so popular. Lots of governments also have their own probably-insecure CAs which are accepted by all browsers. The CA system is a lost cause. Tell me what isn't a lost cause then. Please. Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: theymos on May 20, 2012, 08:41:42 AM Tell me what isn't a lost cause then. Please. I use the Certificate Patrol (http://patrol.psyced.org/) and Perspectives (https://addons.mozilla.org/en-US/firefox/addon/perspectives/) Firefox extensions. I've also disabled most of the CAs in Firefox, though Firefox's handling of invalid certificates is pretty bad, so I don't recommend doing this unless you're paranoid. Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: check_status on May 20, 2012, 09:51:00 AM Quote from: Theymos I use the Certificate Patrol and Perspectives Firefox extensions. I've also disabled most of the CAs in Firefox, though Firefox's handling of invalid certificates is pretty bad, so I don't recommend doing this unless you're paranoid. (If this is OffTopic, let me know. :) )The only problem with Perspectives is they only authenticate the first connection, other stuff on the website, pics, forms are still vulnerable. Have you thought about using Convergence instead? http://convergence.io/ Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: theymos on May 20, 2012, 04:39:55 PM The only problem with Perspectives is they only authenticate the first connection, other stuff on the website, pics, forms are still vulnerable. Have you thought about using Convergence instead? http://convergence.io/ I've heard that Convergence is no longer being actively developed. Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: check_status on May 20, 2012, 10:23:40 PM Well Convergence is accepting Contributions via Bitcoin and via Bit-Pay.
There were active donations sent April through May of 2012. 15TUpE7Qtehxzrx2gMdE6jbHdQa42Edk4G https://i.imgur.com/hzpxV.jpg https://i.imgur.com/Z7ir9.jpg Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: zer0 on May 21, 2012, 04:31:29 PM I'm pretty sure it's still being actively maintained, can always ask moxie or 0day charlie of thoughtcrime labs on twitter if they're still involved, they always reply
Title: Re: [WARNING] Bitcoinica Claims Process is insecure Post by: check_status on May 22, 2012, 08:26:16 AM Me: I heard the Convergence project is no longer being developed, Is this true?
Moxie Marlinspike: Convergence is still being developed, although the core feature set is pretty stable now. Me: Should anyone run a notary? Moxie Marlinspike: Anyone can run a notary, and anyone is free to use that notary if they trust the organization. Me: Who would be your ideal candidate for running a notary? Moxie Marlinspike: Ideally, organizations that can dedicate the resources to running HA notaries are preferred. |
