Godaddy's SSL certs don't work in Java - the right solution

Chrome and other browsers are phasing out SSL certificates that are implemented using the weak SHA-1 hash. As a result, SSL certificate authorities, like GoDaddy are also phasing out SHA-1 in favor of SHA-2. GoDaddy is one of the largest providers, at about 13% of all SSL certificates.

This means that GoDaddy had to switch to their SHA-2 root certificate and get it installed in all the major browsers, OSs, and other important clients. For some reason, it wasn’t installed in some versions of Oracle’s Java 7 or 8. This has caused some problem for Java clients.

Read more about the solution on the Tozny blog.

Blaming users for security incidents is counterproductive

The Associated Press has done some important research into the cause of cybersecurity incidents in the federal government. Unfortunately, they come to the wrong conclusion. They document the huge rise in security incidents, and then add:

"And [federal] employees are to blame for at least half of the problems."

Specifically, not because the employees are the hackers, but because

"They have clicked links in bogus phishing emails, opened malware-laden websites and been tricked by scammers into sharing information."

This is counterproductive. It blames end users for problems that the security community should be taking accountability for.

Read more on the Tozny blog.