Trustworthy 🔑 transport 🚆 for Chrome. HTTPS, certs, encryption, security UX, software eng & mgmt. @estark.bsky.social. Opinions are my own. she/her
San Francisco Bay Area
Joined November 2010
- Tweets3.4K
- Following885
- Followers10.1K
- Likes4.3K
Emily Stark retweeted
A proposed CA/Browser Forum ballot would radically shorten the max validity period of #TLS certificates over the next few years github.com/cabforum/serverce…
Emily Stark retweeted
It's a common misconception that we need to move from AES-128 to AES-256 to counter quantum attack. In this great talk @sejaques explains why, and shows a few new arguments why Grover's algorithm is even less practical than we already understood it to be. youtube.com/watch?v=eB4po9Br…
I will be at TPAC this week! Planning to attend WebAppSec, WebAuthn, various breakouts, and the hallway.
Emily Stark retweeted
I will die on the hill that RTO hurts families with young children the most — and mothers above all when mom is still the default caregiver.
Don’t make people choose between their kids and their careers.
This means that creating passkeys doesn't harm availability of your account. It also means that creating a passkey might not have all the security benefits that one would like.
Great comment from @arturjanc on why Content Security Policy is not a good tool for preventing untrusted code from exfiltrating sensitive data: github.com/w3c/webappsec/iss…
Emily Stark retweeted
How Chrome is planning on rolling on the final standardized version of Kyber / ML-KEM security.googleblog.com/2024…
Emily Stark retweeted
When your 2-year-old starts correctly pronouncing a word she’s been adorably mispronouncing her whole life and you realize that little nonsense word is gone forever
Several years ago I complained that shrug.io doesn't use HTTPS. It still doesn't, but at least the complaint now exists in blog post form: emilymstark.com/2024/06/07/w…
1/ TIL that one of my most favorite websites, shrug.io, doesn't support HTTPS. That means it's time for a rant about why HTTPS is important even for a static website that serves no purpose but to let you copy-paste your favorite emoticon. 🧵
My team has been BUSY! Highlights from this lovely Friday morning:
- Postquantum TLS strategy: blog.chromium.org/2024/05/ad…
- Distrusting CAs w/out breaking existing certs: groups.google.com/a/ccadb.or…
- Updated draft of Trust Expressions for TLS cert negotiation: ietf.org/archive/id/draft-da…
Kudos to @dadrian @davidben__ @ryancdickson @modyoloN, Bob Beck, Chris Clements, and the rest of the team
Emily Stark retweeted
There is a new draft for Trust Expressions. It is trying to address the real-world complexity of TLS deployment by making the ubiquity problem of root certificates manageable it does this by enabling relying parties to succinctly convey which certification authorities they trust. datatracker.ietf.org/doc/dra…
Emily Stark retweeted
Following up with some thoughts on how to think about migrating HTTPS to post-quantum cryptography. It's similar to the HTTPS adoption effort, but not quite the same because lack of post-quantum security is not the same thing as plaintext.
dadrian.io/blog/posts/pqc-no…
With Real World Cryptography coming up next week, I wanted to take an opportunity to point out that our current post-quantum cryptographic primitives are not suitable for the web dadrian.io/blog/posts/pqc-si…
