From cb57aeeafc450e6fbef71a47e3b1d074f08b8e84 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Mon, 9 Nov 2015 20:42:27 +0100 Subject: [PATCH] Updated Home (markdown) --- Home.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Home.md b/Home.md index caaf9ef..7647d3d 100644 --- a/Home.md +++ b/Home.md @@ -29,6 +29,15 @@ without loosing any data. - As a user you have to trust the server administrator, your internet provider and any country the traffic passes not to inject any malicious javascript code. + Ideally, the ZeroBin installation used would provide HTTPS, secured by + [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) and + [HKPH](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) using a + certificate either validated by a trusted third party (check the certificate + when first using a new ZeroBin instance) or self-signed by the server operator, + validated using a + [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) protected + [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) + record. - The "key" used to encrypt the paste is part of the URL. If you publicly post the URL of a paste that is not password-protected, everybody can read it.