Matthew Bryant, a security researcher, writes up vulnerabilities he found, including takeovers of TLDs, Signal Desktop RCE, and npm domain issues.
HN cites it in security discussions, notably the Signal Desktop remote code execution bug and a post on NoScript's limitations.
Signal has security bugs line the best of them. The most famous is probably https://thehackerblog.com/i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/ - which gave full RCE, letting the attacker steal all your messages or worse.
The two critical bugs in question here were similarly implementation bugs in matrix-js-sdk and its derivatives.
Separately, there’s a question over the fact Matrix by design controls group membership on the server… and warns users if malicious devices get added, rather than explicitly forbidding them. We’re fixing that anyway, but it’s questionable if this counts as “issues with e2ee” - it’s similar to deriding Signal for pushing all the users in your addressbook when you join the app(!)
No disagreement on Ghostery; that got uninstalled real fast when I figured out what they were really up to. While I agree that NoScript helps, it doesn't prevent everything either: https://thehackerblog.com/the-noscript-misnomer-why-should-i-trust-vjs-zendcdn-net/
I used to be a big RequestPolicy believer, but single-page apps (which feels like saying "horseless carriages" in mid-2015) make it a lot of work. https://github.com/gorhill/uMatrix/wiki/Changes-from-HTTP-Switchboard is the best thing I've found if you're into granular control over sites. uBlock also has an ~"I'm an advanced user" option which will give you a little more blunt but still useful control over cross-site requests.
From the researcher who found it:
we were able to compile a list of strategic defense-in-depth recommendations for Signal Desktop which we’ve sent to the Signal security team per their request. At the end of the day there will always be new “hot” vulnerabilities, but the “vendor” response is generally what separates the wheat from the chaff. The Signal team’s quick patch time along with a strong interest in mitigating vulnerabilities of this type in the future was encouraging to see. I’ll remain a Signal user for the foreseeable future :)
https://thehackerblog.com/i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/
> You have more control over it, and it is fully accessible from the open web.
Do you want this again? [0] [1]. The so-called 'open web' is complete nonsense which technologists at large tech companies have taken control to push on their next grifting and surveillance products.
For example, Google Chrome being used as the dominant browser and Google already leading control over web standards, privacy violations and sabotaging other browsers like Firefox for their own gain.
There is no such thing as the 'open web'.
[0] https://news.ycombinator.com/item?id=21611677
[1] https://thehackerblog.com/the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/
Appart from DNS many CAs do web or email based checks. And those had quite a few vulnerabilities in the past, e.g. in the extraction of whois records (via OCR...) [1] or through markup injection in the validation emails [2]. CAA can prevent misissuance in such cases.
Having an extra safety layer around these is definitely useful. It's not a super strong measurement like HPKP and CT, but still I think CAA is a useful extra security mechanism in the CA ecosystem.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713
[2] https://thehackerblog.com/keeping-positive-obtaining-arbitrary-wildcard-ssl-certificates-from-comodo-via-dangling-markup-injection/
They absolutely can. Just one example of how ICAAN regulation helps: ICAAN requires that the .org registry let domain owners lock in their current price for 10 years if a price increase is announced, and prohibits different renewal prices for different domains. ccTLDs can just increase prices with no notice, or price gouge popular domains.
And .io is certainly worse than .org will ever be - there have been numerous security outages of the .io name servers and one very bad security incident: https://thehackerblog.com/the-io-error-taking-control-of-all-io-domains-with-a-targeted-registration/index.html