mastodon.ie: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.6
@lewiray : phishing can and should be mitigated.
See https://infosec.exchange/@ErikvanStraten/114222237036021070 and (I just wrote this) https://infosec.exchange/@ErikvanStraten/114224682101772569.
@rohare : thank you! Of course the feature list could be expanded, but many things can also be implemented using browser extensions / plug-ins.
IMO implementing my proposal using extrensions will not work, because we need a revolution, all combined:
1) Trustworthy certificates containing *human readable* (+) information identifying the responsible entity for "risky" websites (DV is fine for your home-NAS because you *know* when a given domain name is *not* yours);
2) Browsers showing that information upon first visit (using that browser, optionally synced cross devices) or when anything changes (website owner in particular);
3) User education. Browsers should contain or point to easy to understand tutorials.
Again, full details in https://infosec.exchange/@ErikvanStraten/113079966331873386.
(+) The cert that Chrome on Android shows for https://stripe.com is NOT human readable, and incomplete as well (see https://crt.sh/?id=17223459392).
NOTE: Apart from the domain name "stripe.com", the only additional identifying information in the cert below is the name of the organization: "Stripe, inc". The information that is *NOT* shown is *EXACTLY* the reason why Google killed EV (and OV) certificates, assisted by (notably) Troy Hunt: https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/.
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLogin