805 reputation
725
bio website johngraybosch.com
location Hauppauge, NY
age
visits member for 3 years, 1 month
seen Jul 28 at 21:53

I'm an Application Developer in Long Island, NY.


Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Sorry, I meant it as italic, not yelling. Just formatting. Oh, ok, so SSLStrip can't attack you per-se, if you type HTTPS in the address bar, but it can block you. And the confused user might try something different. So if they had HTTPS://www.example.com bookmarked, they might trying typing in example.com in their address bar, and pwned.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
I think your first paragraph needs to be reworked to be accurate. It sounds like you're trying to say that the initial HTTP request is vulnerable (before the user has received an HSTS header). On subsequent requests, the browser will not accept an HTTP connection to the site, only an HTTPS connection. PLEASE CLARIFY YOUR FIRST PARAGRAPH TO RECEIVE ACCEPTED ANSWER.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Ok, but this seems to contradict what some responders are saying below. I'm proposing that your site never serves HTTP and that the user types in HTTPS directly in the address bar. You're saying that SSLStrip can redirect the client's browser from HTTPS to HTTP? The responders below seem to indicate that you're safe if you type HTTPS...
Aug
8
asked Mitigating SSLStrip by only serving a site over HTTPS?
Jul
29
awarded  Notable Question
Jul
10
awarded  Popular Question
Jul
8
asked Does ASP.NET guarantee the integrity of a page's controls on a post back?
Jul
2
awarded  Curious
Jun
16
awarded  Popular Question
Jun
12
awarded  Yearling
Apr
4
awarded  Benefactor
Apr
4
accepted WebRTC P2P SSL - Where are the keys generated?
Apr
3
comment WebRTC P2P SSL - Where are the keys generated?
Ok, so assuming it provides trustworthy code, the server that unites the peers has no way of eavesdropping on the peers' communication? Also, I guess because the certificates are self-signed, the peers have no way of assuring each other of their identities, right?
Apr
2
awarded  Promoter
Mar
31
revised WebRTC P2P SSL - Where are the keys generated?
added 77 characters in body
Mar
31
revised WebRTC P2P SSL - Where are the keys generated?
added 234 characters in body
Mar
31
asked WebRTC P2P SSL - Where are the keys generated?
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
Thanks for the detailed answer.
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
I think it would be answerable... It is similar to "How long would it take to brute force a SHA-1 password hash assuming the password was eight characters long?". Except substitute hash for RSA private key, eight characters for 4096 bits.
Mar
26
accepted Possible to Derive Private Key from Public Key Given Enough Computing Power?