A small tool to view real-world ActivityPub objects as JSON! Enter a URL
or username from Mastodon or a similar service below, and we'll send a
request with
the right
Accept
header
to the server to view the underlying object.
{
"@context": [
"https://www.w3.org/ns/activitystreams",
{
"ostatus": "http://ostatus.org#",
"atomUri": "ostatus:atomUri",
"inReplyToAtomUri": "ostatus:inReplyToAtomUri",
"conversation": "ostatus:conversation",
"sensitive": "as:sensitive",
"toot": "http://joinmastodon.org/ns#",
"votersCount": "toot:votersCount",
"litepub": "http://litepub.social/ns#",
"directMessage": "litepub:directMessage",
"Hashtag": "as:Hashtag"
}
],
"id": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760",
"type": "Note",
"summary": null,
"inReplyTo": null,
"published": "2024-07-31T18:08:23Z",
"url": "https://infosec.exchange/@ErikvanStraten/112882437562055760",
"attributedTo": "https://infosec.exchange/users/ErikvanStraten",
"to": [
"https://www.w3.org/ns/activitystreams#Public"
],
"cc": [
"https://infosec.exchange/users/ErikvanStraten/followers",
"https://infosec.exchange/users/BleepingComputer",
"https://beta.mstdn.cf/users/billtoulas"
],
"sensitive": false,
"atomUri": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760",
"inReplyToAtomUri": null,
"conversation": "tag:infosec.exchange,2024-07-31:objectId=180890351:objectType=Conversation",
"content": "<p>Yesterday Bill Toulas wrote (numbers inserted by me):</p><p><<< These certificates are used to encrypt communication (1) between a user (2) and a website or application, increasing security against malicious network monitoring (3) and man-in-the-middle attacks (4). >>><br /><a href=\"https://www.bleepingcomputer.com/news/security/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">bleepingcomputer.com/news/secu</span><span class=\"invisible\">rity/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/</span></a></p><p>*TL;DR*</p><p>(1) Certificates have NOT been used for encryption for a decade or so;</p><p>(2) An https connection implies E2EE (End-to-End-Encryption) between a server and a BROWSER (unfortunately human beings are not capable of being E2EE endpoints);</p><p>(3) Monitoring partially encrypted network packets still provides potentially useful data for attackers, advertisers and/or three-letter agencies - and may be saved to files in order to try to decrypt them later;</p><p>(4) Correct (very effective w.r.t. TLS and https, but very weak when taking into account the "human factor").</p><p>See a detailed explanation (including 4 bonus points) in my followup to this toot.</p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@BleepingComputer\" class=\"u-url mention\">@<span>BleepingComputer</span></a></span> : you may want to read point 7 in particular: i.r.t. the DNS attack you described in <a href=\"https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">bleepingcomputer.com/news/secu</span><span class=\"invisible\">rity/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/</span></a>, Let's Encrypt issued 34 certificates on July 23, of which they revoked 27 (I intend to publish additional details soon; let me know if you're interested in those details in advance).</p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://beta.mstdn.cf/users/billtoulas\" class=\"u-url mention\">@<span>billtoulas</span></a></span> <br /> <br /><a href=\"https://infosec.exchange/tags/Certificates\" class=\"mention hashtag\" rel=\"tag\">#<span>Certificates</span></a> <a href=\"https://infosec.exchange/tags/https\" class=\"mention hashtag\" rel=\"tag\">#<span>https</span></a> <a href=\"https://infosec.exchange/tags/TLS\" class=\"mention hashtag\" rel=\"tag\">#<span>TLS</span></a> <a href=\"https://infosec.exchange/tags/Encryption\" class=\"mention hashtag\" rel=\"tag\">#<span>Encryption</span></a> <a href=\"https://infosec.exchange/tags/Signing\" class=\"mention hashtag\" rel=\"tag\">#<span>Signing</span></a> <a href=\"https://infosec.exchange/tags/DV\" class=\"mention hashtag\" rel=\"tag\">#<span>DV</span></a> <a href=\"https://infosec.exchange/tags/DomainValidation\" class=\"mention hashtag\" rel=\"tag\">#<span>DomainValidation</span></a> <a href=\"https://infosec.exchange/tags/AitM\" class=\"mention hashtag\" rel=\"tag\">#<span>AitM</span></a> <a href=\"https://infosec.exchange/tags/MitM\" class=\"mention hashtag\" rel=\"tag\">#<span>MitM</span></a> <a href=\"https://infosec.exchange/tags/Identification\" class=\"mention hashtag\" rel=\"tag\">#<span>Identification</span></a> <a href=\"https://infosec.exchange/tags/Authentication\" class=\"mention hashtag\" rel=\"tag\">#<span>Authentication</span></a> <a href=\"https://infosec.exchange/tags/Impersonation\" class=\"mention hashtag\" rel=\"tag\">#<span>Impersonation</span></a> <a href=\"https://infosec.exchange/tags/OV\" class=\"mention hashtag\" rel=\"tag\">#<span>OV</span></a> <a href=\"https://infosec.exchange/tags/EV\" class=\"mention hashtag\" rel=\"tag\">#<span>EV</span></a> <a href=\"https://infosec.exchange/tags/QWAC\" class=\"mention hashtag\" rel=\"tag\">#<span>QWAC</span></a> <a href=\"https://infosec.exchange/tags/LE\" class=\"mention hashtag\" rel=\"tag\">#<span>LE</span></a> <a href=\"https://infosec.exchange/tags/LetsEncrypt\" class=\"mention hashtag\" rel=\"tag\">#<span>LetsEncrypt</span></a> <a href=\"https://infosec.exchange/tags/MisIssuance\" class=\"mention hashtag\" rel=\"tag\">#<span>MisIssuance</span></a> <a href=\"https://infosec.exchange/tags/Revocation\" class=\"mention hashtag\" rel=\"tag\">#<span>Revocation</span></a> <a href=\"https://infosec.exchange/tags/Revoked\" class=\"mention hashtag\" rel=\"tag\">#<span>Revoked</span></a> <a href=\"https://infosec.exchange/tags/OCSP\" class=\"mention hashtag\" rel=\"tag\">#<span>OCSP</span></a> <a href=\"https://infosec.exchange/tags/OCSPStapling\" class=\"mention hashtag\" rel=\"tag\">#<span>OCSPStapling</span></a> <a href=\"https://infosec.exchange/tags/CRL\" class=\"mention hashtag\" rel=\"tag\">#<span>CRL</span></a> <a href=\"https://infosec.exchange/tags/CertificateMisIssuance\" class=\"mention hashtag\" rel=\"tag\">#<span>CertificateMisIssuance</span></a> <a href=\"https://infosec.exchange/tags/DNS\" class=\"mention hashtag\" rel=\"tag\">#<span>DNS</span></a> <a href=\"https://infosec.exchange/tags/DNSHijack\" class=\"mention hashtag\" rel=\"tag\">#<span>DNSHijack</span></a> <a href=\"https://infosec.exchange/tags/BGP\" class=\"mention hashtag\" rel=\"tag\">#<span>BGP</span></a> <a href=\"https://infosec.exchange/tags/BGPHijack\" class=\"mention hashtag\" rel=\"tag\">#<span>BGPHijack</span></a> <a href=\"https://infosec.exchange/tags/Trust\" class=\"mention hashtag\" rel=\"tag\">#<span>Trust</span></a> <a href=\"https://infosec.exchange/tags/Reliability\" class=\"mention hashtag\" rel=\"tag\">#<span>Reliability</span></a></p>",
"contentMap": {
"en": "<p>Yesterday Bill Toulas wrote (numbers inserted by me):</p><p><<< These certificates are used to encrypt communication (1) between a user (2) and a website or application, increasing security against malicious network monitoring (3) and man-in-the-middle attacks (4). >>><br /><a href=\"https://www.bleepingcomputer.com/news/security/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">bleepingcomputer.com/news/secu</span><span class=\"invisible\">rity/digicert-mass-revoking-tls-certificates-due-to-domain-validation-bug/</span></a></p><p>*TL;DR*</p><p>(1) Certificates have NOT been used for encryption for a decade or so;</p><p>(2) An https connection implies E2EE (End-to-End-Encryption) between a server and a BROWSER (unfortunately human beings are not capable of being E2EE endpoints);</p><p>(3) Monitoring partially encrypted network packets still provides potentially useful data for attackers, advertisers and/or three-letter agencies - and may be saved to files in order to try to decrypt them later;</p><p>(4) Correct (very effective w.r.t. TLS and https, but very weak when taking into account the "human factor").</p><p>See a detailed explanation (including 4 bonus points) in my followup to this toot.</p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@BleepingComputer\" class=\"u-url mention\">@<span>BleepingComputer</span></a></span> : you may want to read point 7 in particular: i.r.t. the DNS attack you described in <a href=\"https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">bleepingcomputer.com/news/secu</span><span class=\"invisible\">rity/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/</span></a>, Let's Encrypt issued 34 certificates on July 23, of which they revoked 27 (I intend to publish additional details soon; let me know if you're interested in those details in advance).</p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://beta.mstdn.cf/users/billtoulas\" class=\"u-url mention\">@<span>billtoulas</span></a></span> <br /> <br /><a href=\"https://infosec.exchange/tags/Certificates\" class=\"mention hashtag\" rel=\"tag\">#<span>Certificates</span></a> <a href=\"https://infosec.exchange/tags/https\" class=\"mention hashtag\" rel=\"tag\">#<span>https</span></a> <a href=\"https://infosec.exchange/tags/TLS\" class=\"mention hashtag\" rel=\"tag\">#<span>TLS</span></a> <a href=\"https://infosec.exchange/tags/Encryption\" class=\"mention hashtag\" rel=\"tag\">#<span>Encryption</span></a> <a href=\"https://infosec.exchange/tags/Signing\" class=\"mention hashtag\" rel=\"tag\">#<span>Signing</span></a> <a href=\"https://infosec.exchange/tags/DV\" class=\"mention hashtag\" rel=\"tag\">#<span>DV</span></a> <a href=\"https://infosec.exchange/tags/DomainValidation\" class=\"mention hashtag\" rel=\"tag\">#<span>DomainValidation</span></a> <a href=\"https://infosec.exchange/tags/AitM\" class=\"mention hashtag\" rel=\"tag\">#<span>AitM</span></a> <a href=\"https://infosec.exchange/tags/MitM\" class=\"mention hashtag\" rel=\"tag\">#<span>MitM</span></a> <a href=\"https://infosec.exchange/tags/Identification\" class=\"mention hashtag\" rel=\"tag\">#<span>Identification</span></a> <a href=\"https://infosec.exchange/tags/Authentication\" class=\"mention hashtag\" rel=\"tag\">#<span>Authentication</span></a> <a href=\"https://infosec.exchange/tags/Impersonation\" class=\"mention hashtag\" rel=\"tag\">#<span>Impersonation</span></a> <a href=\"https://infosec.exchange/tags/OV\" class=\"mention hashtag\" rel=\"tag\">#<span>OV</span></a> <a href=\"https://infosec.exchange/tags/EV\" class=\"mention hashtag\" rel=\"tag\">#<span>EV</span></a> <a href=\"https://infosec.exchange/tags/QWAC\" class=\"mention hashtag\" rel=\"tag\">#<span>QWAC</span></a> <a href=\"https://infosec.exchange/tags/LE\" class=\"mention hashtag\" rel=\"tag\">#<span>LE</span></a> <a href=\"https://infosec.exchange/tags/LetsEncrypt\" class=\"mention hashtag\" rel=\"tag\">#<span>LetsEncrypt</span></a> <a href=\"https://infosec.exchange/tags/MisIssuance\" class=\"mention hashtag\" rel=\"tag\">#<span>MisIssuance</span></a> <a href=\"https://infosec.exchange/tags/Revocation\" class=\"mention hashtag\" rel=\"tag\">#<span>Revocation</span></a> <a href=\"https://infosec.exchange/tags/Revoked\" class=\"mention hashtag\" rel=\"tag\">#<span>Revoked</span></a> <a href=\"https://infosec.exchange/tags/OCSP\" class=\"mention hashtag\" rel=\"tag\">#<span>OCSP</span></a> <a href=\"https://infosec.exchange/tags/OCSPStapling\" class=\"mention hashtag\" rel=\"tag\">#<span>OCSPStapling</span></a> <a href=\"https://infosec.exchange/tags/CRL\" class=\"mention hashtag\" rel=\"tag\">#<span>CRL</span></a> <a href=\"https://infosec.exchange/tags/CertificateMisIssuance\" class=\"mention hashtag\" rel=\"tag\">#<span>CertificateMisIssuance</span></a> <a href=\"https://infosec.exchange/tags/DNS\" class=\"mention hashtag\" rel=\"tag\">#<span>DNS</span></a> <a href=\"https://infosec.exchange/tags/DNSHijack\" class=\"mention hashtag\" rel=\"tag\">#<span>DNSHijack</span></a> <a href=\"https://infosec.exchange/tags/BGP\" class=\"mention hashtag\" rel=\"tag\">#<span>BGP</span></a> <a href=\"https://infosec.exchange/tags/BGPHijack\" class=\"mention hashtag\" rel=\"tag\">#<span>BGPHijack</span></a> <a href=\"https://infosec.exchange/tags/Trust\" class=\"mention hashtag\" rel=\"tag\">#<span>Trust</span></a> <a href=\"https://infosec.exchange/tags/Reliability\" class=\"mention hashtag\" rel=\"tag\">#<span>Reliability</span></a></p>"
},
"attachment": [],
"tag": [
{
"type": "Mention",
"href": "https://infosec.exchange/users/BleepingComputer",
"name": "@BleepingComputer"
},
{
"type": "Mention",
"href": "https://beta.mstdn.cf/users/billtoulas",
"name": "@billtoulas@beta.mstdn.cf"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/certificates",
"name": "#certificates"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/https",
"name": "#https"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/tls",
"name": "#tls"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/encryption",
"name": "#encryption"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/signing",
"name": "#signing"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/dv",
"name": "#dv"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/domainvalidation",
"name": "#domainvalidation"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/AiTM",
"name": "#AiTM"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/mitm",
"name": "#mitm"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/identification",
"name": "#identification"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/authentication",
"name": "#authentication"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/impersonation",
"name": "#impersonation"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/ov",
"name": "#ov"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/ev",
"name": "#ev"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/QWAC",
"name": "#QWAC"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/le",
"name": "#le"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/letsencrypt",
"name": "#letsencrypt"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/misissuance",
"name": "#misissuance"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/revocation",
"name": "#revocation"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/revoked",
"name": "#revoked"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/ocsp",
"name": "#ocsp"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/ocspstapling",
"name": "#ocspstapling"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/crl",
"name": "#crl"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/certificatemisissuance",
"name": "#certificatemisissuance"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/dns",
"name": "#dns"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/dnshijack",
"name": "#dnshijack"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/bgp",
"name": "#bgp"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/bgphijack",
"name": "#bgphijack"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/trust",
"name": "#trust"
},
{
"type": "Hashtag",
"href": "https://infosec.exchange/tags/reliability",
"name": "#reliability"
}
],
"replies": {
"id": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760/replies",
"type": "Collection",
"first": {
"type": "CollectionPage",
"next": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760/replies?min_id=112882463034102550&page=true",
"partOf": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760/replies",
"items": [
"https://infosec.exchange/users/ErikvanStraten/statuses/112882463034102550"
]
}
},
"likes": {
"id": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760/likes",
"type": "Collection",
"totalItems": 1
},
"shares": {
"id": "https://infosec.exchange/users/ErikvanStraten/statuses/112882437562055760/shares",
"type": "Collection",
"totalItems": 0
}
}