diff --git a/about.xhtml b/about.xhtml index cdfeddf..cdceb11 100644 --- a/about.xhtml +++ b/about.xhtml @@ -1,7 +1,7 @@ - + @@ -206,10 +206,12 @@
  • All server logs purged every 14 days
  • User IP addresses used only for security and debugging purposes (purged along with logs)
    • -
  • All connections made via TLS 1.3 (TLS 1.2 and older are - unsupported) to ensure the most secure AEAD ciphers are used, - along with forward secrecy (each connection uses a different key - to previous connections)
    • +
  • All connections made via + TLS 1.3 + only to ensure the most secure + AEAD + ciphers are used, along with + forward secrecy
  • All connections made via high-security AEAD ciphers, preferring AES-256-GCM for devices with AES hardware-acceleration, and ChaCha20-Poly1305 for devices without @@ -220,17 +222,22 @@ protocols, preferring X25519, with secp256r1 as a fallback (secp256r1 is mandated for TLS 1.3 by IETF RFC8446 section 9.1)
    • -
  • DNSSEC implemented to provide a root-of-trust for encryption - and authentication for domain and server configuration
    • -
  • Certificate Authority Authorization (CAA) records enabled to - prevent all certificate authorities other than Let's Encrypt - from issuing TLS certificates for my domains
    • -
  • Secure Shell fingerprint (SSHFP) records enabled to provide - a DNS-based root-of-trust for SSH connections to my domains
    • +
  • Domain Name System Security Extensions (DNSSEC) + enabled to provide a root-of-trust for encryption and + authentication for domain and server configuration
    • +
  • Certificate Authority Authorization (CAA) + records enabled to prevent all certificate authorities other + than + Let's Encrypt from + issuing TLS certificates for my domains
    • +
  • Secure Shell fingerprint (SSHFP) + records enabled to provide a DNS-based root-of-trust for SSH + connections to my domains
  • Referrer headers disabled to prevent knowing where a user was redirected from
  • All content sourced from my own domains, with third-party - content prohibited via Content Security Policy + content prohibited via + Content Security Policy configuration
  • All servers physically under my control (no VPS or other hosting providers)