I mean, “america” (specifically USA) bad, but that user has no idea bitwarden encrypts the password before sending it to the server.

and details: https://wiki.mozilla.org/SecurityEngineering/Certificate_Transparency

this sounds important:

This information has a 10 week expiration time. That is, if 10 weeks have passed since the information has been updated (typically by updating Firefox itself), the implementation will no longer enforce certificate transparency.

this also means, it can’t truly verify SCT’s that were issued since the last browser update?

it seems Firefox started doing the CT validation too, without needing to contact the CT log service: https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Certificate_Transparency#browser_requirements

apparently certs can have a cryptographic proof of having been included in the CT logs. but what do browsers do if the letsencrypt cert has no such proof?

if its not human readable, how will people know its the place they want to go to? I don’t think bookmarked onionsites is a particularly good idea

Actually the problem is that they are too widespread. if something happened, and they started creating fake certificates, for outside force or otherwise, they can’t just be blocked because literally half of the internet or more breaks. what’s worse, if browser vendors trued that, people would be downgrading their browser to the last version accepting it, and become exposed to publicly revealed security vulnerabilities. not all because its a bit complicated, but enough would do to have it cause an even greater problem.

It’s actually to prove that a web server belongs to (or is trusted by for delivering their content) a specific website.

qualified certificates go a step further, by proving that a web server belongs to a specific company or a real person. but that’s costly, because verification is inherently more difficult.

you don’t know how bitwarden works, do you?

which is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.

the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.

the whois info for the IP might have an abuse email address, try that

Nobody is credibly suggesting that everyone should switch to IPv6 without a firewall.

OP writes:

many ISPs and institutional networks keep doing NATy stuff out of inertia and even more misguided security thinking: firewalls that refuse inbound

Every single domestic router for the past two decades has included a firewall, and that would not change in an all IPv6 world.

my ISP router does not have firewall settings, despite supporting IPv6. it has a DMZ setting, able to forward all incoming traffic to a specific internal IP, and that’s it. I have a similar experience with cheap consumer routers too.

maybe a friend has the 3d printer? also, reduce, reuse, recycle. and finally, it likely consumes less power.

it presents firewalls like some useless burden, I don’t get how can one see it like that in this age

I already considered that, and for an untrusted website I already don’t trust the content or the scripts. So it doesn’t matter if it was modified or not, it’s still untrusted.

but then why are you reading it? is it cat photos and cooking recipes only? or does it have articles about pricey things you could buy, news, life improvement tips, car and other thing repair docs/advice?

I remember reading about some kind of an alternate DNS root servers. they have some unique TLDs (sounds risky though, the possibility of future name clashes). not too popular, but it is being used. I think this is it: https://opennic.org/

but there are more: https://icannwiki.org/Alternative_Roots

though, it will not salvage the .org TLD. such a shame it got to that…

I don’t agree, I think there is a difference in likely outcomes. but even without scripts, you don’t want you article’s content (text, images, statements or names) be falsified by an attacker. Unless you are just reading the article to waste time, and magically what you read will not influence your views.

If you inspect the generated timer you see the same format in the OnCalendar line.

but without the command

What do you mean by persisted? The service and timer will both be there as long as the timer doesn’t end. Which it won’t in my example.

I mean saved to a file so that it will still be there after reboot

SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web.

it is a huge benefit if a man in the middle cannot run scripts on your computer.

So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.

there is no problem with that. this could work, with the required patch to firefox, also in the repo.

then why use DANE. this is just plain old TOFU

the repo readme writes about this. Firefox does not yet support DANE, it needs a patch, included in the repo.