Hardenize Blog

If you like ssllabs, you will love https://www.hardenize.com Much more intel, better performance and a better UI. No affiliation, just a fan since day one.

It's a tricky question, and I've spent years of my life trying to answer it. Hey, I am a security person and a developer and I don't always trust myself to do the right thing. No matter how much time I spend educating myself, there's _always_ something I still need to learn. At the operating system level, the bare minimum is run only the services you need, have a firewall that refuses unwanted traffic, and to patch regularly. If you can, automatically apply security patches. In terms of application security, in the ideal case you will have a budget that allows you to hire professionals to take a look at your systems, both from the inside and the outside. Simplifying, internal reviews usually try to answer the question "is this correctly built", whereas external reviews usually focus on "can we get in". If you don't have a budget (as many small operations don't), I'd recommend the following approach: 1) Make sure you fully understand XSS and SQL injection vulnerabilities. These two are usually responsible for the majority of security issues in applications. The latter can easily lead to full data loss. Understanding them is not easy, but it's manageable. Once you know enough, make sure your applications are not vulnerable. CSRF is something that you should look into, also. 2) Security is not something developers can ignore, so allocate some time every week to learn something new. Even though this is a never-ending task, after a couple of months (and years) you will be…

https://Hardenize.com Its founder, Ivan Ristić, has nice books as well.

It does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com nowadays, over ssllabs for these kind of queries.

https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!

What might be interesting to be notified about is certificate issued but not deployed (i.e. in CT logs, but not presented by web server). What's the compelling reason to use this over, say, Hardenize[1] or Oh Dear[2]? [1]: https://www.hardenize.com/ [2]: https://ohdear.app/

I agree that for most people, that's probably an exhausting list to go through. I'm a fan of Hardenize. I like using that site to help people understand what needs to be done. https://www.hardenize.com

How about they fix their long-standing security issues first. Particularly their DMARC is set to "p=none" which is essentially disabled at a time large providers are mandating properly functioning DMARC. Anyone can spoof email account of other Fastmail users (1). Their #1 job is email, yet Fastmail has poor security scores still in 2024 (2). MTA-STS should be enabled for any competent email host. (1) https://news.ycombinator.com/item?id=18997054 (2) https://www.hardenize.com/report/fastmail.com/1723612173

It’s been mandatory since 2018. Browsers will reject certificates which have not been publicly logged. Perhaps next you’ll wonder if it’s as simple as compromising a CA and a CT log? Nope, as browsers require cryptographic attestations from multiple CT logs. If you’re using Chrome, one of those logs has to be the one operated by Google. Also such collusion will soon be defeated by SCT auditing https://www.hardenize.com/blog/certificate-transparency-sct-auditing https://docs.google.com/document/d/16G-Q7iN3kB46GSW5b-sfH5MO3nKSYyEb77…

And downgrade attacks are mitigated by MTA-STS: https://www.hardenize.com/blog/mta-sts Not supported by everyone just yet since this is a new standard, but Gmail at least supports it.