Light

Episode #1065 Quiz

Attestation
Date: 2026-02-17 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Episode 1065 covers significant security topics including Chrome 145’s introduction of Device Bound Session Credentials, which bind session cookies to devices using secure enclaves like TPMs to prevent cookie theft misuse.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the primary security benefit introduced by Chrome 145's Device Bound Session Credentials feature?

Question 1

According to the episode, what is the primary security benefit introduced by Chrome 145's Device Bound Session Credentials feature?

Encrypting session cookies on the server to prevent interception. Binding session cookies to the specific device that received them to prevent reuse elsewhere. Storing session cookies in the browser's encrypted storage container to prevent theft. Requiring multi-factor authentication for every session cookie use.

Question 2: What new attestation requirement did the CA/Browser Forum add for issuing code signing certificates starting in 2026, as described by Steve Gibson?

Question 2

What new attestation requirement did the CA/Browser Forum add for issuing code signing certificates starting in 2026, as described by Steve Gibson?

Code signing certificates require face-to-face biometric verification of the applicant. Applicants must provide a notarized self-declaration of business legitimacy. A licensed attorney or CPA must provide an attestation letter confirming the applicant's organizational identity. Applicants must register their code signing keys with a global blockchain ledger.

Question 3: What operational issue did AI.com experience during its Super Bowl advertisement, according to the episode?

Question 3

What operational issue did AI.com experience during its Super Bowl advertisement, according to the episode?

A DNS misconfiguration caused the domain to be unreachable during the event. The website suffered a database corruption that delayed response times. The website's backend server was unable to scale sufficiently to handle the sudden traffic spike. Cloudflare's CDN was overwhelmed by traffic and failed to deliver content.

Question 4: Why did the first known malicious Microsoft Outlook add-in succeed in stealing user credentials, as explained in the episode?

Question 4

Why did the first known malicious Microsoft Outlook add-in succeed in stealing user credentials, as explained in the episode?

Because the attacking party claimed an abandoned developer's domain URL hosted by Vercel and deployed phishing content. Because Microsoft did not digitally sign any Office add-ins before publishing. Because the add-in's manifest allowed automatic updates without review by Microsoft. Because users downloaded the add-in from unverified third-party websites outside Microsoft's Store.

Question 5: What was Steve Gibson's perspective on shortening TLS/SSL certificate lifetimes to approximately six months, as mandated starting February 2026?

Question 5

What was Steve Gibson's perspective on shortening TLS/SSL certificate lifetimes to approximately six months, as mandated starting February 2026?

He considered it an inconvenient change that increases operational burden without clear benefits. He viewed it as a necessary improvement with no downsides. He was bitterly disappointed; saw it as an unnecessary hassle that complicates renewal and validation processes. He encouraged all users to switch immediately to paid certificates from DigiCert for better security.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.