blog.google

Most-linked posts?

1. /2014/09/gradually-sunsetting-sha-1.html
   2 people · 2 mentions · first linked 2015-04-07
2. /2014/08/https-as-ranking-signal_6.html
   2 people · 2 mentions · first linked 2014-08-08
3. /2011/08/update-on-attempted-man-in-middle.html
   2 people · 2 mentions · first linked 2013-07-31

What Hacker News says?

1. michaelt · 2013-07-31

   Traditionally you generate an SSL public and private key, and send only the public key to the certificate authority for signing, so compromising the certificate authority doesn't give you the private key. It does however give you the ability to issue yourself new public keys to conduct man-in-the-middle attacks [1]. If you compromise the same CA as the site whose traffic you're trying to intercept, you can bypass ce…

   Comment linking /2011/08/update-on-attempted-man-in-middle.html

   on “XKeyscore: NSA program collects 'nearly everything a user does on the internet'”
2. kmfrk · 2013-05-24

   Submitted Changes to our SSL Certificates as a story · 4 points

   HN discussion
3. StringyBob · 2014-04-22

   This is great. I'd love to see this extended for natural images with whatever algorithm Google uses for OCR in streetview - http://googleonlinesecurity.blogspot.co.uk/2014/04/street-vi...

   Comment linking /2014/04/street-view-and-recaptcha-technology.html

   on “Project Naptha: a browser extension that enables text selection on any image”
4. esolyt · 2014-03-30

   Submitted Google’s Public DNS intercepted in Turkey as a story · 3 points

   HN discussion
5. agwa · 2015-04-07

   Chrome only cares about the hash algorithm of the intermediate certificate(s) if the end-entity cert is expiring after 2016. So a SHA-1 certificate expiring in 2015 won't be marked insecure even if it's signed by a SHA-1 intermediate expiring in 2020. See: http://googleonlinesecurity.blogspot.co.uk/2014/09/gradually...

   Comment linking /2014/09/gradually-sunsetting-sha-1.html

   on “Next Chrome Update Will Block SHA-1 Certificates”
6. morphics · 2013-08-13

   Submitted Security rewards at Google: Two MEEELLION Dollars Later as a story · 3 points

   HN discussion
7. FiloSottile · 2015-04-07

   Author of the embedded tweet here. I'd like to clarify, since my tweet was vaguely imprecise and this post sadly got it wrong. The official timeline is on Google Online Security blog [1]. BUT you have to replace "41" with "42" [2]. SO, what changes? From version 42, the current "beta", which according to schedule [3] should become "stable" in a week on the 14th: - certs that expire in 2016 will be yellow - certs tha…

   Comment linking /2014/09/gradually-sunsetting-sha-1.html

   on “Next Chrome Update Will Block SHA-1 Certificates”
8. morphics · 2013-06-07

   Submitted Increased rewards for Google’s web vulnerability reward programme as a story · 3 points

   HN discussion
9. alanbyrne · 2014-08-08

   Does it bother anyone else that when you try to visit the Google post explaining that they are using HTTPs as a ranking signal via https it redirects to http? http://googleonlinesecurity.blogspot.co.uk/2014/08/https-as-...

   Comment linking /2014/08/https-as-ranking-signal_6.html

   on “CloudFlare enabling free SSL by mid-October”
10. johnterry_cfc · 2014-02-09

    Submitted Keeping YouTube Views Authentic as a story · 2 points

    HN discussion
11. adamt · 2013-06-12

    The NSA doesn't need to break Google/Facebook/Twitter's private key. They just need to have bought/stolen/subpoenaed/cracked the private key of any CA that is in your browser. E.g. a mole inside GoDaddy/RSA or anyone with an intermediate chained certificate. This would then enable a man-in-the-middle SSL attack. There are some challenges about implementing this with just a port-mirror or TAP, but it is possible. For…

    Comment linking /2013/01/enhancing-digital-certificate-security.html

    on “CloudFlare, PRISM, and Securing SSL Ciphers”
12. morphics · 2014-02-05

    Submitted Google now offer security bounty rewards for official Chrome extensions as a story · 2 points

    HN discussion
13. 72deluxe · 2015-11-02

    Very interesting and thought provoking. The article links to Google's page on finding 1000 bugs in FFmpeg ( https://googleonlinesecurity.blogspot.co.uk/2014/01/ffmpeg-a... ). This mentions the fixes they found (NULL pointer dereferences, Invalid pointer arithmetic leading to SIGSEGV due to unmapped memory access, Out-of-bounds reads and writes to stack, heap and static-based arrays, Invalid free() calls, Double free…

    Comment linking /2014/01/ffmpeg-and-thousand-fixes.html

    on “Fuzzing FFmpeg for fun and profit”
14. derpenxyne · 2012-06-19

    Submitted Google Safe Browsing: Protecting Web Users for 5 Years and Counting as a story · 2 points

    HN discussion
15. abritishguy · 2014-04-26

    That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on...

    Comment linking /2011/08/update-on-attempted-man-in-middle.html

    on “CAcert.org – A community-driven Certificate Authority issuing free certificates”
16. grey-area · 2012-08-30

    Submitted Content hosting for the modern web as a story · 1 points

    HN discussion
17. micro-ram · 2015-05-14

    It might have been low last year. This year with the deprecation of Windows XP, pagerank boost for HTTPS[1] and free certs and caching from CloudFlare[2] all of my sites are now SNI. Some are even HSTS. [1] http://googleonlinesecurity.blogspot.co.uk/2014/08/https-as-... [2] https://www.cloudflare.com/ssl

    Comment linking /2014/08/https-as-ranking-signal_6.html

    on “Bing Webmaster Tools does not support HTTPS SNI”
18. sparknlaunch · 2012-06-06

    Submitted Google warns of suspected state-sponsored attacks as a story · 1 points

    HN discussion

Search all of HN for googleonlinesecurity.blogspot.co.uk

Linked by the same people?

• BBruce Schneierschneier.com