Notices by Per Thorsheim (thorsheim@mastodon.social)

@dalias No, I wasn't advocating for them to offer DANE. I said that without DANE they can totally forget selling their solution to at least some governments in Europe.

I am onboard the digital sovereignty train, but *some* realism won't hurt. And again: risk analysis. Not paranoia or FUD.

You probably know this one already:
https://european-alternatives.eu/categories

@dalias Well, this thread got started with you not trusting an american maker of software / provider of cloud solutions.

Me?
I do risk analysis. There is information that I would never send on email, period.

Lets agree to disagree and stop here.

@dalias There still exist mailservers out there supporting SSLv3, and while BCP 195 from 2021 deprecates the use of TLS 1.0/1.1, they are still very much in use on mailservers, in combination with weak cipher suites.

So I wouldn't be so sure about harvest now decrypt later not succeeding.

The Google transparency report on email also shows that even some BIG mail domains doesn't even do STARTTLS today. I did some work on this in 2014-2015 to make "everyone" use it. :)

https://transparencyreport.google.com/safer-email/overview

@dalias Oh, I wouldn't fully trust that. "Harvest now, decrypt later" has its own Wikipedia article, and mailservers doesn't necessarily run with TLS 1.3 PQC cipher suites quite yet.

@dalias well, your emails are going through routers and switches made in China or in the US anyway, so…

Risk analysis and common sense.

@dalias DANE provides mandatory authenticated encryption, as long as both parties supports DANE (and has valid dnssec). Still not E2E encryption by far, just mailserver to mailserver.

Add REQUIRETLS (RFC8689) and RPKI for BGP along the route way, and we're getting closer.

But targeted attacks will always exist, and there is always a way.

Where in the world is Proofpoint.com with DNSSEC + DANE?

They don't support it. Why not?
The competition does. Take note Gartner!

There are tons of (potential) customers within EU that are not allowed to use Proofpoint without such support!

I'm addressing Proofpoint in a new article on Linkedin:

https://www.linkedin.com/pulse/where-world-proofpoint-dnssecdane-per-thorsheim-hqxue/

US gov asks european suppliers to guarantee they don't do DEI.

Next: we ask US to guarantee they do fair pay, 5 weeks paid annual vacation and 1 year paid maternity leave.

CONGRATULATIONS WORLD!
🇺🇸

MEETUP i Oslo torsdag 14 mars!

Gjentar suksessen fra 25 januar og inviterer til høyst uformell, ingen agenda, mat og prat meetup sentralt i Oslo.

Nasjonal sikkerhetsmyndighet kjører sin årlige sikkerhetskinferanse 13-14 mars, så en "post-mortem" meetup torsdag 14 passer utmerket for alle oss som ikke får nok av infosec, personvern og mere til.

Pling meg på Signal (+47 90999259) om du har lyst til å være med, så drar jeg deg inn i dedikert meetup gruppe.

@chetwisniewski @boblord
1) do not use security questions. :)
2) if you use a pwd.manager, use that to generate & remember random pwds as answers to security questions
3) if a service provider uses security questions, tell them to stop using them.
4) Recommending them a little bit of MFA, in particular WebAuthn/passkeys, is a good idea.
5) Tell them using security questions is close to negligence, if not gross negligence, of recommended practices & standards today.