Tag Info

New answers tagged

0

TL;DR yes it is safe provided that you trust the means by which you came across the value stored in PUB_KEY. Here is some background that is needed to first understand the purpose of pinning, and why your scenario allows for ignoring of the error. I'll concentrate specifically on PKI in an ideal implementation. A private key is a very, very large number ...


2

A trusted root is only relevant if you need to validate the trust chain of the certificate until you get the root. If you only expect a specific certificate or public key there is no need to check any chains and in lots of cases there is no trust chain anyways (i.e. self-signed certificates). In case of revocation you might actually add an URL to the ...


1

I figured it out! The SSL handshake was failing on my (client) side because the client certificate did not have the right permissions for the account that was running the web application. I was able to find this out by looking in 'Windows Event Viewer' under 'Windows Logs --> System'. There I saw an error stating: "A fatal error occurred when attempting to ...


0

I found this post where someone had received the same error phrase "The request was aborted: Could not create SSL/TLS secure channel." (although i reckon this as a very generic description). It says that you need to install the client certificate in the local computer store. Did you do that? If not, how does it work out for you?


3

Given that the VPN headers around each packet will take up space and then disappear, they could be looking at packet size vs MTU to come up with a way of guessing (it would be a wild guess) that the user is behind a VPN because their packets are consistently smaller than other streams. An even wilder guess would be that they are looking at round trip time ...


5

Finding out that a user is using a VPN service provider isn't that difficult. Most of them have static IP addresses for their exit gateways, so it could just be using a list of known IP addresses to identify VPNs. And even when they don't have a list, a simple reverse DNS lookup might tell them that the IP has a hostname which is obviously a VPN provider and ...


2

Possibly partial answer. First an aside: you don't need to "secure" a public key by changing bits; the whole purpose and point of public-key cryptography is that it is secure even though the public key is public, which includes available to adversaries. That publickey form you have is NOT just "modulus and exponent". It is true that the last 3 bytes in ...


3

Yes, this is one of use cases that Protected Data (and the underlying DPAPI) was expressly designed for, and is generally probably the best mechanisms at your disposal. One thing I'd add is that it's best to set the DataProtectionScope to CurrentUser, which will offer stronger protection, because the data isn't available to other users and processes on ...


1

From what you described, it's not secure at all, for a bunch of reasons. The top two being: You're downloading data over HTTP. Even if AES provides confidentiality, it doesn't provide message authenticity or integrity. You're using hard-coded keys. Pulling those out would be trivial, even with obfuscation. This would mean I could MitM your traffic and send ...



Top 50 recent answers are included