@GossiTheDog if you read this https://www.lighthousereports.com/investigation/flight-of-the-predator/ and listen to @jackrhysider predator episode, you reach the same conclusion without Vodafone telling you.

@GossiTheDog Interception is easy if I have control of the wire.

@GossiTheDog
Should we be surprised? Is the UK one of these countries, I think it's safe to presume all comms are up for grabs unless we ensure we are using trustworthy apps/services.

@GossiTheDog I mean they can ask, the correct response is usually to tell them to go fuck themselves. Not that everyone does

@nazgul @GossiTheDog @chort It expired because of DNS…

@GossiTheDog And this isn't a cache issue or anything, I've been trying to approve it all day. Mouse moves offscreen to hit refresh because apparently when I do a screen recording at 2am I forget what "F5" does.

@tweedge @GossiTheDog Maybe because it's a link to a .ru site?

@elizabeth
STARTTLS is the most widely used port by #xmpp clients, as it allows selecting the right server domain (this predates TLS SNI by quite a while, and then there is inertia). Many xmpp servers don't even offer Direct TLS, and IIRC no client will directly probe it, if there is no explicit SRV record for Direct TLS.
@GossiTheDog

@lienrag @GossiTheDog The attacker was apparently able to issue valid LE certs for the affected domain, so unless something like certificate pinning was used on the client they wouldn't notice anything wrong with the cert.

@lienrag nope

@kyhwana @GossiTheDog that seems to have happened during the recorded downtime (because ACME checks connectivity from multiple undisclosed sources, you need to intercept every incoming connection during the check)