4d2.su: 4d2 dot org Proof of Security (Beta)

About this application - click to show The problem: We've recently seen privacy-oriented services come under attack in several ways, from legislative saber-rattling like the EU's Chat Control initiative to an extremely concerning Man-in-the-Middle TLS attack where major hosting companies likely cooperated with law enforcement to violate the privacy of jabber.ru users.

In the jabber.ru attack, hosting companies used their privileged network position to obtain phony TLS certificates for jabber.ru services. These were then secretly used to create an intermediate termination point for secure traffic. Users and site admins saw that connections were encrypted, but communication was presumably being decrypted and funneled elsewhere. This continued for months before it was noticed.

How we're defending ourselves: We already take some precautions against this kind of attack that jabber.ru didn't. On this page we try to close some remaining gaps by testing the validity of our own certificates using as many mutually uncooperative parties as possible, making it as difficult as we can for a MitM attack against us to go unnoticed. Here's how it works:
  • This site uses a domain name registered in the .su top-level domain, a small (~100k domains) and somewhat lawless TLD originally created for the USSR in 1990. These domain names are currently difficult to register or modify, and the .su TLD's operators are unlikely to cooperate with government agencies outside of Russia. This makes a DNS hijack in the .su top-level zone unlikely.
  • Our DNS provider in Iceland has a history of non-cooperation with foreign authorities, and DNSSEC is used in all zones that support it. This makes a hijack of our local DNS zones unlikely.
  • The server hosting this page is leased from a different provider in a different country than our other machines. Sophisticated network attacks would require cooperation between parties.
  • This server uses a different CPU architecture and OS layout than our other machines, so it's less likely to be vulnerable to the same casual exploits.
  • Every few minutes, the servers hosting our public services (email, Matrix, CryptPad, etc.) export the SHA-256 fingerprint and validity dates of all their TLS certificates. This data comes from the local copies of these certificates on each application server. These fingerprints and validity dates are pushed to this machine via SSH with key-based authentication.
  • Every few minutes, a client machine that we control makes a TLS client connection to each of our applications that supports TLS, and logs the SHA-256 fingerprint and validity date it receives from the server. The results are then sent to this machine using SSH.
  • This app compares the data received by these two mechanisms. If certificate fingerprints or validity dates don't match, we flag that entry as "suspicious" on this page.
  • Each exchange of certificate information between servers also exchanges a randomly-generated UUID. The UUIDs received by this machine are displayed here, and the UUIDs sent by each remote machine are linked directly from those machines for you to compare. An attacker who compromised this app to display fake data would have to compromise all our machines for the UUIDs to match.
This is not absolute protection from an impersonation attack, or anything close. It just tries to make such an attack as inconvenient, expensive and obvious as possible.

Install our Proof of Security Client for automated monitoring from a machine you trust.
Service NameLocal FingerprintFingerprint to ClientLocal ExpiryExpiry to ClientLE Account IDTrust Status
4d2.link
17:D1:27:58:90:9F:D9:20B7:97:31:B0:B0:E2:DC:66:B5:8D:BC:73:F7:C6:6C:52:32:BC:2C:A7:2E:1E:BC:0A:17:D1:27:58:90:9F:D9:20
17:D1:27:58:90:9F:D9:20B7:97:31:B0:B0:E2:DC:66:B5:8D:BC:73:F7:C6:6C:52:32:BC:2C:A7:2E:1E:BC:0A:17:D1:27:58:90:9F:D9:20
Nov 25 22:48:31 2024Aug 27 22:48:32 2024 - Nov 25 22:48:31 2024
Nov 25 22:48:31 2024Aug 27 22:48:32 2024 - Nov 25 22:48:31 2024
76782206https://acme-v02.api.letsencrypt.org/acme/acct/76782206
OK
4d2.org
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
76782206https://acme-v02.api.letsencrypt.org/acme/acct/76782206
OK
4d2.social
C5:F7:1C:2F:A8:09:82:02C1:41:DE:18:FC:52:5D:A9:AE:05:43:10:0B:E1:72:42:9B:E4:DE:21:0A:BB:75:92:C5:F7:1C:2F:A8:09:82:02
C5:F7:1C:2F:A8:09:82:02C1:41:DE:18:FC:52:5D:A9:AE:05:43:10:0B:E1:72:42:9B:E4:DE:21:0A:BB:75:92:C5:F7:1C:2F:A8:09:82:02
Jan 21 06:22:22 2025Oct 23 06:22:23 2024 - Jan 21 06:22:22 2025
Jan 21 06:22:22 2025Oct 23 06:22:23 2024 - Jan 21 06:22:22 2025
1801268617https://acme-v02.api.letsencrypt.org/acme/acct/1801268617
OK
4d2.su
30:7E:BD:80:8B:AE:1E:918E:EE:21:EC:6A:FF:D9:05:9F:62:92:3A:30:D4:11:E0:51:5D:E8:2A:CE:E6:4D:E9:30:7E:BD:80:8B:AE:1E:91
Verify this manuallyCheck cert details in your browser - Verify this SHA-256 fingerprint manually
Jan 20 19:39:45 2025Oct 22 19:39:46 2024 - Jan 20 19:39:45 2025
Verify this manuallyCheck cert details in your browser - Verify this manually
2014851357https://acme-v02.api.letsencrypt.org/acme/acct/2014851357
ImplicitThis server can't attest for itself
bayard.4d2.org
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
76782206https://acme-v02.api.letsencrypt.org/acme/acct/76782206
OK
cinny.4d2.org
57:15:58:04:EB:81:50:5361:EA:56:B7:6D:E2:EC:49:2F:C1:EB:56:0E:14:BF:C8:EF:63:40:8B:27:6E:87:60:57:15:58:04:EB:81:50:53
57:15:58:04:EB:81:50:5361:EA:56:B7:6D:E2:EC:49:2F:C1:EB:56:0E:14:BF:C8:EF:63:40:8B:27:6E:87:60:57:15:58:04:EB:81:50:53
Dec 22 21:26:55 2024Sep 23 21:26:56 2024 - Dec 22 21:26:55 2024
Dec 22 21:26:55 2024Sep 23 21:26:56 2024 - Dec 22 21:26:55 2024
1434949786https://acme-v02.api.letsencrypt.org/acme/acct/1434949786
OK
depot.4d2.org
FE:2D:23:25:BB:FB:D9:C1E9:84:D2:6C:3B:59:35:14:71:C9:4C:A8:B6:29:B7:EB:4B:A0:54:61:00:03:D2:81:FE:2D:23:25:BB:FB:D9:C1
FE:2D:23:25:BB:FB:D9:C1E9:84:D2:6C:3B:59:35:14:71:C9:4C:A8:B6:29:B7:EB:4B:A0:54:61:00:03:D2:81:FE:2D:23:25:BB:FB:D9:C1
Nov 26 05:38:19 2024Aug 28 05:38:20 2024 - Nov 26 05:38:19 2024
Nov 26 05:38:19 2024Aug 28 05:38:20 2024 - Nov 26 05:38:19 2024
1914608496https://acme-v02.api.letsencrypt.org/acme/acct/1914608496
OK
element.4d2.org
14:39:29:B0:CA:79:CB:1980:BA:C1:2E:7E:1D:E8:BC:B9:37:3F:BB:2B:01:90:86:68:38:7C:CB:F3:BF:63:34:14:39:29:B0:CA:79:CB:19
14:39:29:B0:CA:79:CB:1980:BA:C1:2E:7E:1D:E8:BC:B9:37:3F:BB:2B:01:90:86:68:38:7C:CB:F3:BF:63:34:14:39:29:B0:CA:79:CB:19
Dec 22 21:26:38 2024Sep 23 21:26:39 2024 - Dec 22 21:26:38 2024
Dec 22 21:26:38 2024Sep 23 21:26:39 2024 - Dec 22 21:26:38 2024
1434949786https://acme-v02.api.letsencrypt.org/acme/acct/1434949786
OK
jitsi.4d2.org
DD:53:45:2E:23:56:F1:D45C:4B:6A:C0:90:EC:37:59:82:DC:B6:C6:85:96:9E:9F:1C:6C:2B:5F:AE:3C:32:9B:DD:53:45:2E:23:56:F1:D4
DD:53:45:2E:23:56:F1:D45C:4B:6A:C0:90:EC:37:59:82:DC:B6:C6:85:96:9E:9F:1C:6C:2B:5F:AE:3C:32:9B:DD:53:45:2E:23:56:F1:D4
Dec 22 21:26:30 2024Sep 23 21:26:31 2024 - Dec 22 21:26:30 2024
Dec 22 21:26:30 2024Sep 23 21:26:31 2024 - Dec 22 21:26:30 2024
1434949786https://acme-v02.api.letsencrypt.org/acme/acct/1434949786
OK
matrix.4d2.org
34:5A:02:52:8A:12:5F:2804:5E:4F:66:82:F8:43:4B:13:02:63:8A:83:79:FB:BF:CE:57:58:CE:8B:C5:B3:13:34:5A:02:52:8A:12:5F:28
34:5A:02:52:8A:12:5F:2804:5E:4F:66:82:F8:43:4B:13:02:63:8A:83:79:FB:BF:CE:57:58:CE:8B:C5:B3:13:34:5A:02:52:8A:12:5F:28
Dec 22 21:26:46 2024Sep 23 21:26:47 2024 - Dec 22 21:26:46 2024
Dec 22 21:26:46 2024Sep 23 21:26:47 2024 - Dec 22 21:26:46 2024
1434949786https://acme-v02.api.letsencrypt.org/acme/acct/1434949786
OK
pad.4d2.org
48:9B:28:B7:5E:6C:90:CB11:03:AA:89:33:6F:FF:9A:87:35:79:04:C5:7B:4D:18:B2:9A:19:3C:A5:89:5A:45:48:9B:28:B7:5E:6C:90:CB
48:9B:28:B7:5E:6C:90:CB11:03:AA:89:33:6F:FF:9A:87:35:79:04:C5:7B:4D:18:B2:9A:19:3C:A5:89:5A:45:48:9B:28:B7:5E:6C:90:CB
Nov 27 19:35:04 2024Aug 29 19:35:05 2024 - Nov 27 19:35:04 2024
Nov 27 19:35:04 2024Aug 29 19:35:05 2024 - Nov 27 19:35:04 2024
1914608496https://acme-v02.api.letsencrypt.org/acme/acct/1914608496
OK
padsbx.4d2.org
48:9B:28:B7:5E:6C:90:CB11:03:AA:89:33:6F:FF:9A:87:35:79:04:C5:7B:4D:18:B2:9A:19:3C:A5:89:5A:45:48:9B:28:B7:5E:6C:90:CB
48:9B:28:B7:5E:6C:90:CB11:03:AA:89:33:6F:FF:9A:87:35:79:04:C5:7B:4D:18:B2:9A:19:3C:A5:89:5A:45:48:9B:28:B7:5E:6C:90:CB
Nov 27 19:35:04 2024Aug 29 19:35:05 2024 - Nov 27 19:35:04 2024
Nov 27 19:35:04 2024Aug 29 19:35:05 2024 - Nov 27 19:35:04 2024
1914608496https://acme-v02.api.letsencrypt.org/acme/acct/1914608496
OK
vault.4d2.org
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
07:C9:54:71:0F:36:46:79A2:B2:53:47:DB:F3:BD:81:C6:B5:17:E1:CB:76:39:B5:13:3B:AD:51:20:AC:94:95:07:C9:54:71:0F:36:46:79
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
Jan 12 04:32:50 2025Oct 14 04:32:51 2024 - Jan 12 04:32:50 2025
76782206https://acme-v02.api.letsencrypt.org/acme/acct/76782206
OK
Last updated at Nov 07 03:10:21 2024. All times UTC.
Last update from arthur at Nov 07 03:10:00 2024
     Linux arthur.4d2.org 6.11.4-1-aarch64-ARCH #1 SMP PREEMPT_DYNAMIC Thu Oct 17 17:10:25 MDT 2024 aarch64 GNU/Linux
     UUID Received: 42d90ebb-2ca6-4012-8239-b223eb67fa95
     UUID Sent: Compare
Last update from bayard at Nov 07 03:10:00 2024
     FreeBSD bayard.4d2.org 14.1-RELEASE FreeBSD 14.1-RELEASE releng/14.1-n267679-10e31f0946d8 GENERIC amd64
     UUID Received: c672fe1c-9cb5-11ef-b68d-5d7b03522583
     UUID Sent: Compare
Last update from zaphod at Nov 07 03:10:01 2024
     Linux zaphod.4d2.org 6.11.1-arch1-1 #1 SMP PREEMPT_DYNAMIC Mon, 30 Sep 2024 23:49:50 +0000 x86_64 GNU/Linux
     UUID Received: b85ca5d9-b202-4865-acfc-e10869ab9f49
     UUID Sent: Compare
Last update from zarniwoop at Nov 07 03:10:01 2024
     Linux zarniwoop.4d2.org 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64 GNU/Linux
     UUID Received: 32a12908-0497-4f31-a28e-8502a253e718
     UUID Sent: Compare

What attacks are still possible, and how do I mitigate them?
How can I find out right away if there's a new security problem?
You can install our Proof of Security Client on a machine you own and schedule it to run regularly.

Back to 4d2 dot org