• 0 Posts
  • 94 Comments
Joined 1 年前
cake
Cake day: 2024年8月12日

help-circle


  • Yes, cloudflare will not tamper with your record because you are not important enough to be worth the reputation loss. Realistically, no harm will come to you from cloudflare.

    However! They are still the party that could theoretically cause the largest amount of damage to both you and your users.

    Cloudflare cannot track visitors of my website, the only malicious thing they can do is to tamper with my DNS record.

    They “cannot” only because they say so. Changing your DNS record allows them to read 100% of all incoming traffic even if it is TLS encrypted (because they can acquire a valid TLS certificate for your domain through a DNS challenge).


  • DNS is the most important foundational stone. Whoever controls your DNS can redirect all of your users to any address they want AND present a valid TLS cert through a DNS challenge. They can also redirect all E-Mails of the associates domain, and if any address was used to register an account, they can reset that accounts password. Trusting someone to handle your DNS is the highest trust you can put on someone on the internet. And that is both for a website povider trusting the registrar of their domain and for a end user with their DNS resolver.



  • With a tiny bit of offsec you can make pretty bulletproof setup.

    Work only exists inside of a Win11 VM. It never touches the underlying system! All files associated with that VM (most importantly the virtual disk) live on a separate partition, or better separate drive. That partition is not mounted in fstab. So under normal circumstances it should never be mounted. So any fuck up they do to their Linux system will leave that partition untouched. If worst comes to worst that can boot a live iso from USB and run their work VM from there.

    I would trust that setup infinitely more than having windows as a base system.












  • Super easy. Technology has existed for quite some time and was already used in the encrpytion of web traffic.

    Basically: you sign up with your “age verification institution” (ideally a service of your government because they have your ID anyway and no profit motive). This involves createing a private key (reaaaaaaaaaaly long password that is saved in a file on your device) and saving the public key with that institution. They also check your ID to ensure your identity and your age.

    When you want to visit a 18+ website, the website sends you a nonce (loooooong random number). You take that nonce and send it to the verifier, along with a signature of your private key (and the age they want you verified against). The verifier verifies your signature using your public key. They then sign the nonce with their own private key, thereby verifying, that you, the owner of your private key (whos identity and age they have verified) are above the asked age theshould. You then send the signed nonce back to the 18+ website and they can verifiy the signature to confirm that a trusted age verifier has verified your age.

    The site never has access to your identity and the verifier never knows which site you visited, only that you wanted to visit a website that wants to know if you are of a certain age.

    (The corresponding technology was used for OCSP Stapling in TLS verification … and has been discontinued last year because nobody was using it …)


  • The cosmologies are difficult to compare because “power” in middle earth is just kinda … power. Sauron doesn’t need to have a “chain lightning lvl 10, 100.000 damage per second” ability. He can just … exist, and all the evil (or just lesser willed) creatures around will just fully accept him as their leader and do whatever he says. It a cosmic force or aura that is never quantified in any way. Same with ganfalf. He does very little magic. His power is also mostly in his presence that compels the good guys to do good things.