0
votes
1answer
150 views

Can I use crypto.getRandomValues to create a private key?

In the window.crypto spec: http://www.w3.org/TR/WebCryptoAPI/#RandomSource-interface It says explicitly: "Do not generate keys using the getRandomValues method. Use the generateKey method ...
3
votes
2answers
422 views

Crypto Browser add-on

What are the known limitations with browser addon/extensions that do in browser encryption vs a native implementation in the browser. The addon would expose cryptographic primitives for use in ...
3
votes
0answers
66 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
7
votes
3answers
432 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
2
votes
1answer
174 views

Browsers and export regs. Is SGC still valid?

I was reading a rather "dated" book on SSL/TLS, which mentions about International Step Up certificates and Microsoft's Server Gated Certificates which were the way arround the US export rules for ...
14
votes
1answer
596 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
10
votes
4answers
994 views

Why isn't OCSP required by default in browsers?

According to the following screenshot, taken from firefox-3.6.17-1.fc14.i686, Firefox has an option to fail closed when unable to connect to OCSP servers. Can someone please explain why this isn't ...