790 reputation
725
bio website johngraybosch.com
location Hauppauge, NY
age
visits member for 3 years
seen Jun 17 at 17:02

I'm an Application Developer in Long Island, NY.


Jun
12
awarded  Yearling
Jun
9
accepted Is SQL Server 2016's Deterministic Encryption any good?
Jun
5
asked Is SQL Server 2016's Deterministic Encryption any good?
May
7
awarded  Notable Question
Apr
11
awarded  Popular Question
Mar
30
awarded  Popular Question
Mar
11
awarded  Popular Question
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
@BenVoigt Gotcha. So the Superfish debacle enables a clandestine active MITM attack, but not a passive attack nor offline decryption of captured traffic.
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
@BenVoigt so then couldn't an attacker spoof the server and proxy the client's requests and perform a MITM attack, similar to SSL Strip? Except I think in this case HSTS wouldn't help...
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
Can an attacker on open WiFi also decrypt your SSL traffic, since they know the private key?
Dec
16
comment Does injecting querystring values directly into HTML pose a security risk?
Golden rule: Never trust user input.
Nov
21
awarded  Notable Question
Oct
14
awarded  Popular Question
Sep
24
awarded  Autobiographer
Sep
22
awarded  Popular Question
Sep
13
awarded  Popular Question
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Thanks. I understand the attack better now. Time to update some sites... lol
Aug
11
revised Mitigating SSLStrip by only serving a site over HTTPS?
added 394 characters in body
Aug
11
accepted Mitigating SSLStrip by only serving a site over HTTPS?
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Oh and I get your first paragraph now. Any client HTTP request can be intercepted and proxied, even if the site only supports HTTPS.