Re:Confidentiality at FastMail
by brongondwana on Tuesday December 16, 2014 @01:55AM
(#8756132)
Yeah, I figured that was kinda self evident. We wouldn't leave any security holes open. I guess I can edit the blog post to clarify this without changing the meaning any.
Re:Confidentiality at FastMail
by breakingcups on Tuesday December 16, 2014 @04:20AM
(#8756400)
I'm curious about the insignificant issues.
Re:Confidentiality at FastMail
by brongondwana on Tuesday December 16, 2014 @07:16AM
(#8756783)
Things like insecure SSL options (we knew that, but wanted to support older devices for a little longer - we've bitten the bullet and switched to SHA256 certs now, and turned off RC4)
They recommended a bcrypt hashing factor which isn't realistic for fast responses, it would have pegged a core for over a second.
A few things that were just testbed specific, and a couple of rate limits we had missed.
Some "internal details leaked in errors" - in two minds about that. Sometimes it helps debug. We mostly log the verbose error internally now and give the user a unique key that makes log grepping easy. Harder to self-help if you hit an error we didn't make a nice error code for yet though and you have tech clue.
Strangely, they don't mention the results of this audit, which struck me as odd, but then I found this:
> Our most recent security audit, conducted by Matasano in October 2014, found no significant issues. (Source[0])
I just thought I'd share in case anyone else was wondering.
[0] https://www.fastmail.com/help/ourservice/security.html?domai...