• 2 Posts
  • 11 Comments
Joined 5 months ago
cake
Cake day: June 21st, 2024

help-circle





  • The blog post contains an interesting tineline. Apparently, the first fix was not sufficient. So if you have updated Vaultwaren before November 18, update it again.

    Copy of the timeline:

    • End of October 2024: ERNW assesses Vaultwarden for the customer.
    • November 08, 2024: ERNW discloses the vulnerabilities to the Vaultwarden team.
    • November 10, 2024: Fix and release of Vaultwarden v1.32.4.
    • November 11, 2024: ERNW retests the software and identifies that the fix is not sufficient.
    • November 11, 2024: Public merge with fix and request for feedback by the Vaultwarden team.
    • November 12, 2024: ERNW acknowledges that the fix is complete.
    • November 18, 2024: Release of Vaultwarden v1.32.5.





  • AFAIK, the only reason not to use Letsencrypt are when you are not able to automate the process to change the certificate.

    As the paid certificates are valid for 12 month, you have to change them less often than a letsencrypt certificate.

    At work, we pay something like 30-50€ for a certificate for a year. As changing certificates costs, it is more economical to buy a certificate.

    But generally, it is best to use letsencrypt when you can automate the process (e.g. with nginx).

    As for the question of trust: The process of issuing certificates is done in a way that the certificate authority never has access to your private key. You don’t trust the CA with anything (except your payment data maybe).