News for hackers. Stuff that matters.

A comment on Ask HN: Best practices for safeguarding master password in organization?. Parent comment

Re:Ask HN: Best practices for safeguarding master password i... by lsedgwick on Tuesday September 26, 2023 @12:56PM (#37662225)
Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.
[ Parent | on HN ]
Re:Ask HN: Best practices for safeguarding master password i... by thinkmassive on Tuesday September 26, 2023 @01:50PM (#37663127)
What tools are you seeing offered for download there?

Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.

[ Parent | on HN ]
Re:Ask HN: Best practices for safeguarding master password i... by matrss on Tuesday September 26, 2023 @02:05PM (#37663376)
It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.
[ Parent | on HN ]
Re:Ask HN: Best practices for safeguarding master password i... by thinkmassive on Tuesday September 26, 2023 @08:38PM (#37668083)
My apologies, I didn’t realize those were links.

Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.

[ Parent | on HN ]
Re:Ask HN: Best practices for safeguarding master password i... by matrss on Wednesday September 27, 2023 @07:15AM (#37673022)
To be fair, the color is misleading. I associate red text with dead links and that is the only reason I checked what they point at.
[ Parent | on HN ]
Re:Ask HN: Best practices for safeguarding master password i... by ficklepickle on Tuesday September 26, 2023 @02:51PM (#37664046)
It serves the cert for 0pointer.net, which is served from the same IP. I think it is more likely to be a poorly configured personal site than something nefarious.

If you are concerned, 0pointer.net has contact info.

[ Parent | on HN ]