Internet security

>>60837891
Really appreciate this kind of thread, but I don't have time to write yet.
Oh and thanks for not choosing fucking Cyber Security. Fuck Cyber.

File: randy.jpg (23KB, 500x500px) Image search: [Google]

23KB, 500x500px

every /wdg/ faggot needs to read these

Mods pls sticky

File: 1489508396529.png (455KB, 479x477px) Image search: [Google]

455KB, 479x477px

>internet
>security
Pick one

>>60838052
Looking past your intended nihilism this does has some truth in it. The current Internet is a mess and it's surprising it's actually working for most things we do.

But the Internet is here to stay and instead of suggesting the inherit mutual exclusiveness between the Internet and security (which is not true for a number of reasons), we should learn from our mistakes in the past and design *and implement* better systems and protocols with better security at their foundation.

>>60837891
I'm using DNSSEC (default is RSASHA256, 2048-bit, 5yr rollover) to combat domain spoofing for the most part in regards to email's, lessening the chances for clients mail to be marked as spam by large mail services such as gmail and outlook online. Thankfully, it's easy to implement with Plesk, so it's not like it's hard to do. I have not heard of TLSA, but I'm willing to look into it. Just not willing to put in a lot of effort to implement it though if it can't be easily managed.

>>60838822
That's great, I do roughly the same but for my own domain, without a COTS solution. Personally I use a different DNSSEC algorithm, but I want to use the Ed25519 algorithm which my zone signing utility sadly doesn't support yet.

Regarding TLSA RRs (DANE), the record just holds a copy or a hash of your certificate. In essence it replaces the necessity for certification authorities (CAs) to validate your certificate's authenticity. This trust relationship is moved to DNSSEC which everyone can query and validate for all domains.

For example, when you make a connection to a server which presents you with a signed certificate, you then query the corresponding TLSA RR of the same domain. If the certificate you're presented with by the server matches the TLSA RR of the authoritative name server, then you can be sure that certificate is indeed valid and you can establish a connection to the server using TLS.

>>60837891
>1024-bit RSA in the trust chain
Wew. Why isn't 4chan.org signed with that 2048-bit key?

>>60839536
If you're after a similar strength, just use a 4k bit key size. It'll be marginally slower, but should theoretically be stronger than ed25519, since it's apparently approximated to 3k bit RSA, both of which are currently unbreakable with current tech.

>>60839771
1024 bit is enough maybe when this graph was made, but it's likely they'll change it to 2048 within the next year or two, as it'll be expected to be breakable by 2020.

Thanks for the info OP. This is so much info that I don't even know where to start.