Top all-time · #5457
Hardenize Blog
Company blog · hardenize.com/blog · on HN as ivanrsecurityweb
Hardenize Blog is the company blog at hardenize.com, writing about security and web. Since 2016, 15 different Hacker News readers have linked it 28 times, most often “Hardenize”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN commenters link Hardenize as a tool for checking TLS and domain security and seeing what needs fixing, often preferring it to SSL Labs. Its blog posts on MTA-STS and CT logs are cited as sources.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hardenize provides a comprehensive and free assessment of web site network and security configuration.
Most-linked posts?
- Hardenize4 people · 7 mentions · first linked 2017-05-16
- Introducing MTA Strict Transport Security (MTA-STS)4 people · 5 mentions · first linked 2018-06-27
- Certificate Transparency: SCT Auditing3 people · 3 mentions · first linked 2021-03-30
- Hardenize: Making web site security easy and fun2 people · 3 mentions · first linked 2016-11-01
- /2 people · 2 mentions · first linked 2022-04-11
What Hacker News says?
I agree that for most people, that's probably an exhausting list to go through. I'm a fan of Hardenize. I like using that site to help people understand what needs to be done. https://www.hardenize.com
Comment linking /
on “Chrome 68 will mark all HTTP sites as “not secure””Submitted Introducing MTA Strict Transport Security (MTA-STS) as a story · 9 points
HN discussionhttps://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!
Comment linking /
on “I must announce the immediate end of service of SSLPing”Submitted Certificate Transparency Policies Diverge After Apple's Update as a story · 4 points
HN discussionIt does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com nowadays, over ssllabs for these kind of queries.
Comment linking /
on “I must announce the immediate end of service of SSLPing”Submitted Introducing MTA Strict Transport Security (MTA-STS) as a story · 3 points
HN discussionAnd downgrade attacks are mitigated by MTA-STS: https://www.hardenize.com/blog/mta-sts Not supported by everyone just yet since this is a new standard, but Gmail at least supports it.
Comment linking /blog/mta-sts
on “The PGP Problem”Submitted Certificate Transparency: SCT Auditing as a story · 2 points
HN discussionFor a comprehensive check-up of network and security configuration, take a look at Hardenize https://www.hardenize.com . It covers a variety of things such as DNS/DNSSEC/DANE and CAA, email security (e.g., SPF, DMARC), TLS, X.509, HSTS, HPKP, CSP, SRI, cookies, application security and so on. It's a work in progress, currently in preview. Disclosure: Hardenize is my project. I previously built SSL Labs.
Comment linking /
on “Ask HN: Website go-live checklist app”Submitted Introducing MTA Strict Transport Security (MTA-STS) as a story · 2 points
HN discussionIt’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged. Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google. Also such collusion will soon be defeated by SCT auditing https://www.hardenize.…
Comment linking /blog/certificate-transparency-sct-auditing
on “Why offer an Onion Address rather than just encourage browsing-over-Tor?”Submitted Monitoring deprecated Symantec certificates as a story · 1 points
HN discussionIf you like ssllabs, you will love https://www.hardenize.com Much more intel, better performance and a better UI. No affiliation, just a fan since day one.
Comment linking /
on “The Impending Doom of Expiring Root CAs and Legacy Clients”Submitted Hardenize as a story · 1 points
HN discussionFor some time now I've been working on a new project with the idea that you want to use a single testing tool that can give you comprehensive, coherent, and deep advice. It's early days and there's a lot to add still, but even now it's pretty good: https://www.hardenize.com Hardenize starts with the domain name (WHOIS), then DNS/DNSSEC/CAA, then email configuration (SMTP/STARTTLS/DANE/SPF/DMARC), then your web appli…
Comment linking /
on “HTTP security headers”Submitted Hardenize: Making web site security easy and fun as a story · 1 points
HN discussionAdditionally, MTA-STS has recently been approved as Proposed Standard, so we may see increased support for it in the near future. [1] The key advantage of MTA-STS is that it can be deployed quickly, without almost any disruption of the already-deployed infrastructure. Of course DNSSEC and DANE already solve the same problem, but MTA-STS is the designed by and for people who don't want to use DNSSEC. The EFF's effort…
Comment linking /blog/mta-sts
on “STARTTLS Everywhere”Submitted Hardenize: Making web site security easy and fun as a story · 1 points
HN discussionHow about they fix their long-standing security issues first. Particularly their DMARC is set to "p=none" which is essentially disabled at a time large providers are mandating properly functioning DMARC. Anyone can spoof email account of other Fastmail users (1). Their #1 job is email, yet Fastmail has poor security scores still in 2024 (2). MTA-STS should be enabled for any competent email host. (1) https://news.yc…
Comment linking /report/fastmail.com/1723612173
on “Introducing passkey support to Fastmail”There are some nuances to Certificate Transparency (CT) that are worth highlighting: - Technically, certificates are not required to be recorded in CT logs. If not submitted, they're still perfectly valid, but they won't be accepted by clients who insist on CT (e.g., most browsers). They will work perfectly well in all other situations. - At the point of use, certificates must be accompanied by proofs of submission…
Comment linking /blog/certificate-transparency-sct-auditing
on “Ask HN: Intercepting HTTPS – How can we trust anything?”When I needed a security policy for my startup, I looked everywhere and couldn't find anything that made sense. I only found policies that are very, very, verbose, so much that I didn't know what to do with them. And most often outdated. In the end, we wrote our own, focusing on producing something that's comprehensive yet concise. (After all, if it's not concise, no one is going to be able to understand it.) We're…
Comment linking /about/security_policy
on “Security policy audits: Why and How”https://Hardenize.com Its founder, Ivan Ristić, has nice books as well.
Comment linking /
on “Badssl.com (2017)”What might be interesting to be notified about is certificate issued but not deployed (i.e. in CT logs, but not presented by web server). What's the compelling reason to use this over, say, Hardenize[1] or Oh Dear[2]? [1]: https://www.hardenize.com/ [2]: https://ohdear.app/
Comment linking /
on “Show HN: Never have an SSL certificate expire again”Looks very nice and clean visually. I have some suggestions from a lookup or two: - Add support for SVCB and HTTPS records - When you lookup CAA, you return flags as a string. It should be an integer. - JSON is nice as an option, but I would optimise the output for people to read. - I really like the main font. The subtitle under the logo ("A simple DNS lookup tool") looks thin in comparison. I would consider using…
Comment linking /report/d53.co/1708030537
on “A simple DNS lookup tool”Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of standards, from DNS, over email, TLS and PKI, and application security. Although Hardenize was a commercial product (it was acquired in 2022 by another company, Red Sift), it has a public report that's always been free. For example: https://www…
Comment linking /report/feistyduck.com
on “RFC 9849. TLS Encrypted Client Hello”It's a tricky question, and I've spent years of my life trying to answer it. Hey, I am a security person and a developer and I don't always trust myself to do the right thing. No matter how much time I spend educating myself, there's _always_ something I still need to learn. At the operating system level, the bare minimum is run only the services you need, have a firewall that refuses unwanted traffic, and to patch…
Comment linking /
on “Ask HN: How can I learn to secure my application infrastructure against attacks?”There's already a system in place to record most public certificates in a way that facilitates monitoring and auditing. It's called Certificate Transparency (CT); you'll find more about it at https://certificate.transparency.dev Google designed it and made it a requirement for certificates to be considered trusted in Chrome. It's since been adopted by Apple and Microsoft. The basic idea is that participating CAs mus…
Comment linking /
on “Ask HN: Monitoring for HTTPS Certificate Issuance?”
