I know plenty account SNI already, but thanks. You might want to study more yourself, since we’re being condescending.

https://blog.cloudflare.com/encrypted-sni/

So now your ISP sees all of your queries instead of CF. (Assuming the cloudflared option is using DoH)

I’ll trust Cloudflare over Comcast/AT&T/etc. any day of the week.

I found it amusing that these posts were adjacent.

Yeah, but that security patch level.

I believe you. I’m just saying their non-firewalls (i.e., switches and APs) don’t have that limitation.

My firewall is a Fortigate 60F.

I would never use their firewalls/gateways, but their switches are pretty good for the price and their APs are decent (although tbh after 3 generations my next AP will likely be an enterprise Aruba).

That said, I still use Unifi in docker, everything is up to date, and nothing is requiring a sign-in to the cloud. Am I missing something? If it’s just the firewalls, then I’m not surprised since I’ve never been remotely tempted to use them, but it sure isn’t all of their devices.

We can restrict the use of software TOTP, which is what companies are doing when they move users onto the MS Authenticator app.

Admins can’t control the other TOTP apps like Google Authenticator or Authy unless they go full MDM. And I don’t think someone worried about installing the MS Authenticator app is going to be happy about enrolling their phone in Intune.

Edit: And even then, there is no way to control or force users to use a managed device for software TOTP.

This is incredibly well said and I agree 100%. I’ll just add that software TOTP is weaker than the MS Authenticator with number matching because the TOTP seed can still be intercepted and/or stolen by an attacker.

Ever notice that TOTP can be backed up and restored to a new device? If it can be transferred, then the device no longer counts for the “something you have” second factor in my threat model.

While I prefer pure phishing-resistant MFA methods (FIDO2, WHFB, or CBA), the support isn’t quite there yet for mobile devices (especially mobile browsers) so the MS Authenticator is the best alternative we have.

Same here. Parent poster needs to learn that other people have different needs and experiences than themselves.

Don’t worry, the FBI confiscated all of their phones but they received other phones and SIMs without data.

I agree as long as the money is actually going toward building out the charging network and not just getting sucked up by corporations like the ISPs that were supposed to improve our network infrastructure.

Although it would be nice for them to let us know what is happening and when we can expect some real improvements. Maybe that info is out there, but I haven’t seen it and this biased reporter sure isn’t looking to do any real journalism.

In that case, if CF is taking to Traefik and not the actual origin server, you just need to forget about the origin certs altogether and use LE certs in Traefik.

If you, Traefik, and your origin server are on the same network, then it’s going to be one hop regardless of whether you’re hitting the Traefik proxy or the origin server. If Traefik is serving up the origin server’s cert and not the LE cert, then Traefik is misconfigured to pass through instead of proxy, but I’m still not sure that’s the case as it’s almost harder to configure it that way than the correct way as a proxy.

What IP:port is your origin server listening on, what IP:port is Traefik listening on, and how is Traefik configured to reach the origin server?

You said Traefik is getting certs from Cloudflare, but do you mean it’s getting Let’s Encrypt certs using a CF DNS challenge? And if that is the case, then your browser should trust the Traefik endpoint since LE certs are publicly trusted.

Are you sure you’re hitting Traefik when you get a cert warning? You need to update your internal DNS if not.

Same. 2014.

There are two different, and only slightly related, things here:

1. Access to company data through your phone (via Teams, Outlook, etc)
2. Using your phone as an MFA device to access company data, even on your work-issue laptop and to access browser-based SaaS apps like your payroll system.

The first absolutely can and should depend on the age of your device. MAM or MDM policies combined with Conditional Access should block older devices not receiving security updates from accessing and storing company data.

The second, assuming they are now requiring phishing-resistant MFA, only requires that you have the Microsoft Authenticator app installed (FIDO2 and CBA are alternate PRMFA methods, but more complicated to implement). The MS Authenticator is supported on Android 8.0 and above and your S8 supports Android 9.0.

So unless there is a job requirement to use your phone for email and Teams – in which case they should definitely offer a stipend or CYOD phone – you should be fine just installing the MS Authenticator app on your phone and using your work-issue laptop for email and Teams.

Edit: I just saw your other comment that they use Duo. In that case you might be hosed since it requires Android 11.0. I’d at least start by opening a ticket with the help desk and keep an email trail with your manager of what part of your job you can’t do. But they should be able to provide a method of authentication that complies with their policies.

Third. The first thing I mention when one of my clients asks anything about PCI is to offload as much card processing onto third parties as possible.

And if you have nothing in place yet, then 100% offloaded should be possible (with the possible exception of secure payment terminals if you need to process physical cards).

That said, it is still possible to use your own hosted WordPress storefront and offload the payment processing via tokenization or redirection. But a turnkey solution like Shopify might be better if you lack the experience.

It’s been a minute but I remember it as a panel of scientists looking down on him, almost as if in a court room. Now I definitely need to rewatch.

If I recall it’s only like 10 minutes and either no dialog or in French. But it’s easy to get the gist of it and worth a watch. And it unlocked the thought experiment about someone witnessing their own death through time travel that Terry Gilliam expertly ran with.