Reputation
675
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 18
Newest
 Yearling
Impact
~31k people reached

Jan
20
comment How is an HTTPS login secure when pages use HTTP?
@ThomasPornin, "It is highly plausible that caching benefits much more Ebay's infrastructures than Gmail's. However, and that's the tricky point, SSL prevents most of this caching." At least one CDN seems to have solved the latter problem, which would seem to imply eBay is, today, even less justified in using plain HTTP than it might have been a couple of years ago. Or is my understanding incorrect?
Jan
10
comment How to avoid identity theft at key signing parties?
@sebastiannielsen, also, if it were necessary in the case of identity theft, presumably it would be much less trouble over all to get your credit card company to cancel the credit card and issue a replacement with a new number, and then to update any necessary recurring bills, etc, than it would be to cancel your SSN and get the government to issue you with a new one, and then to update all the other records that depended on the original SSN.
Jan
9
comment Secure Configuration of Ciphers/MACs/Kex available in SSH
@TomLeek, does the SLOTH attack change this?
Jan
8
answered How to protect contact forms against being misused for mass-mailing?
Jan
1
awarded  Yearling
Oct
31
comment Testing a hardware random number generator
"Recently, a researcher demonstrated that it was possible to patch microcode for Intel processors to look for unique patterns in the instruction buffer and detect when the RDRAND instruction was being used to fill the /dev/random pool." Any chance of a citation/hyperlink to that research? Thanks!
Oct
12
awarded  Popular Question
Oct
1
comment Is Bluetooth 4.0 traffic encrypted by default/design?
Mike Ryan has the answers you seek :)
Sep
30
comment Detecting and removing Absolute persistance technology
@Nikhil_CV, I've no idea whether there is a dedicated chip, or indeed if the rootkit persists by homing itself in multiple chips/firmwares/etc (e.g. is it related to "Intel Anti-Theft Technology" in many modern Intel CPUs?). If you know more than I do, then please expand on your comment in an answer, and provide sources for your information. Thanks!
Sep
13
comment Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
@schroeder. Meta: seriously? Life's too short. This is a legitimate question: no doubt at all.
Sep
13
comment Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
@schroeder, thanks for your comment, but that's a misreading of the question. The question is: what was the talk (i.e. who, when, where). That's not asking for a link, it is entirely asking about a historical development in infosec: the public presentation of a specific rationale for a specific change in browser vendor security policy. While a link might make an answer more complete, it isn't actually required. I'm afraid I disagree with your & RoryAlsop's opinions on this.
Sep
13
revised Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
Rolled back edit by Schroeder
Sep
13
revised Detecting and removing Absolute persistance technology
added 943 characters in body
Sep
13
revised Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
Rolled back edit by Rory Alsop
Sep
13
comment Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
@RoryAlsop, the video is very much about infosec, and is potentially a useful reference for anyone in the field. As such, the question is on topic: it's asking for further information (a reliable source) on a specific (and indeed notable) subject within infosec. Please could you therefore re-open it? Thanks.
Sep
11
comment Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
Thanks for your answer (upvoted!), & your comment. I'd seen one of those two Moxie talks before. Sadly, I'm pretty sure neither of them is the talk I had in mind, as I recall the speaker making the point that it was nonsensical to warn users more strongly about HTTPS with invalid certs than about HTTP. However, the talks you've linked to do come very close , hence the upvote. Incidentally, of the two you linked, the one in your comment above was closest, as it includes clear screenshots of the warnings, so by all means delete your comment & add its content into your answer! Thanks again :)
Sep
11
revised Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
added 111 characters in body
Sep
11
revised Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
rolled back to a previous revision
Sep
11
asked Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated?
Jul
24
awarded  Constituent