738 reputation
522
bio website johngraybosch.com
location
age
visits member for 2 years, 5 months
seen yesterday

I'm an Application Developer in Long Island, NY.


Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Thanks. I understand the attack better now. Time to update some sites... lol
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Oh and I get your first paragraph now. Any client HTTP request can be intercepted and proxied, even if the site only supports HTTPS.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Sorry, I meant it as italic, not yelling. Just formatting. Oh, ok, so SSLStrip can't attack you per-se, if you type HTTPS in the address bar, but it can block you. And the confused user might try something different. So if they had HTTPS://www.example.com bookmarked, they might trying typing in example.com in their address bar, and pwned.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
I think your first paragraph needs to be reworked to be accurate. It sounds like you're trying to say that the initial HTTP request is vulnerable (before the user has received an HSTS header). On subsequent requests, the browser will not accept an HTTP connection to the site, only an HTTPS connection. PLEASE CLARIFY YOUR FIRST PARAGRAPH TO RECEIVE ACCEPTED ANSWER.
Aug
11
comment Mitigating SSLStrip by only serving a site over HTTPS?
Ok, but this seems to contradict what some responders are saying below. I'm proposing that your site never serves HTTP and that the user types in HTTPS directly in the address bar. You're saying that SSLStrip can redirect the client's browser from HTTPS to HTTP? The responders below seem to indicate that you're safe if you type HTTPS...
Apr
3
comment WebRTC P2P SSL - Where are the keys generated?
Ok, so assuming it provides trustworthy code, the server that unites the peers has no way of eavesdropping on the peers' communication? Also, I guess because the certificates are self-signed, the peers have no way of assuring each other of their identities, right?
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
Thanks for the detailed answer.
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
I think it would be answerable... It is similar to "How long would it take to brute force a SHA-1 password hash assuming the password was eight characters long?". Except substitute hash for RSA private key, eight characters for 4096 bits.
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
See also: stackoverflow.com/questions/12952729/…
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
Thanks Tom. Please see my update to my question and feel free to add your comments.
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
Yes that's what I was looking for. It's a curiosity. I was wondering if what you pointed me to exists. And I was wondering: do virus scanners use this? If not, why not?
Sep
14
comment How to detect the NSA MITM attack on SSL?
How did the NSA know the private key of the CA in the brazil case?
Sep
14
comment How to detect the NSA MITM attack on SSL?
Fixed the backbone router assumption.
Aug
7
comment Encrypting Fields in Database
@Saladin Actually in this scenario, the web application will only decrypt the key from the web.config on the pages or reports where the sensitive info needs to be retrieved. The idea is that ASP.NET has already authenticated the user through the auth cookie. This prevents an unauthenticated user from finding a SQL injection vulnerability on any arbitrary page and accessing the plain text info. This does not protect the info in the case of a stolen session.
Aug
2
comment Where can I get security breach alerts?
I like the national vulnerability database, which basically covers the same info as CVE, but you can get an RSS feed. nvd.nist.gov
Jul
9
comment Is it possible to prove which public key was used to encrypt a message?
I understand the difference. So to you my question might be, can you prove, mathematically that ciphertext C must have been encrypted by RSA public key K? Or if not prove, suggest with a high probability?
Jul
9
comment Is it possible to prove which public key was used to encrypt a message?
@Clockwork-Muse If Alice signed her message with her key before encrypting the message with Bob's key, then yes... But I'm not sure otherwise, hence the question. Please see my update.
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Hmm I guess the ASP.NET implementation is probably a question better asked on Stack Overflow.
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Why the downvote?
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Any idea how you'd accomplish this in ASP.NET?