• 0 Posts
  • 10 Comments
Joined 10 months ago
cake
Cake day: November 10th, 2023

help-circle
  • For encryption, the client and server need to share their private keys.

    This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.

    The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).

    For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.

    The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.


  • Don’t bother with the cert if it’s not your job, but at least look into CCNA Routing and Switching. There are tons of courses available, both in person and online, as well as numerous YouTube videos on the subject.

    See if your local library or community college has an adult education center that provides a course. At some point, you will need to learn subnetting, which is just math, but practice makes perfect, and your life is easier if you have it committed to memory.

    Proper written work is still one of the most effective ways to do this.






  • Why are you running a VPN? If you are simply shielding your internet activity from your ISP, Google won’t give a shit where you sign in from.

    If you are browsing to shield your identity, you want to be fully disassociated with any non-secure browsing habits. If this is your use case, even if you are using discrete internet accounts, tracking cookies are common enough that, you would still be identifiable from your browser fingerprint. It all depends on what your risk factors are, and how much you want to spend to mitigate them.



  • The biggest mistake users will make is thinking their data is safe JUST because they have a NAS or a RAID. It’s common parlance in Systems Administration that RAID is NOT backup.

    To wit— not truly understanding RAID and how it relates to capacity, parity, and especially the time required to rebuild in failed disk situation. It is a crucial mistake to use RAID 5 with greater than 2TB disks, and even that is pushing it, but RAID 5 is at least in the zeitgeist.

    There are also some outside concerns such as Drive batch dates and knowing to pre-purchase spare disks well in advance that may hamper recovery.