450 reputation
37
bio website decbis.tumblr.com
location New York, United States
age 38
visits member for 4 years, 6 months
seen May 3 at 2:51

Jan
30
comment Bank login in foreign country
@limbenjamin True, but they will if they think they can get 10 $100,000 ones or 100 $10,000 ones. What I'm saying is that TLS in itself, without certificate pinning and/or extra certificate verification (think Perspectives Project or Convergence.io), will not protect you from MITM attacks.
Jan
30
comment Bank login in foreign country
@limbenjamin To me somebody getting to my bank account is more important than somebody getting to national secrets. And I see fraudulent certificates be created for banks and such. ymmv
Jan
29
comment Bank login in foreign country
TLS by itself will not protect you from a MITM attack, think fraudulent certificates issued by compromised (i.e. DigiNotar) or government owned CAs. As a side note SSL stripping is a form of MITM attack.
Nov
11
awarded  Yearling
Jun
8
awarded  Constituent
Jun
8
awarded  Caucus
Nov
11
awarded  Yearling
Jun
4
awarded  Commentator
Jun
4
comment Firefox Desktop Shortcut Being Renamed
Are you sure the shortcut is for Firefox and not for some html file (which will be show Firefox' icon since it's the default handler of html files)?
May
6
awarded  Editor
May
6
revised extract from pcap all protocols found
added 320 characters in body
May
6
answered extract from pcap all protocols found
Feb
11
comment What should I ask a prospective security consultant?
Perhaps you should ask if he/she saw this question & answers :)
Jan
26
comment What is an intermediate certificate authority?
I did not argue the possibility, rather the complexity. Tnx for the update.
Jan
24
comment SSL Certificate revocation check
@user1157: Because both CRL & OCSP checks are something that it's up to the client to do, it's not part of the SSL protocol.
Jan
24
comment What is an intermediate certificate authority?
That quote is so out of context and incomplete it's not even funny... There are a lot more things (that are a lot more complex to set up and deploy) that need to happen before a government agency having an Trusted Intermediate CA can "intercept, decrypt, and monitor secured SSL connections of any and all kinds."
Jan
24
comment SSL Certificate revocation check
@user1157: at the handshake stage after the server certificate is retrieved. It's up to the client (i.e. browser) to verify the server's certificate in any way it likes (i.e. has a valid certificate chain, it uses a strong certificate signature algorithm, it's not expired, Common name matches URL, it's not in the list of revoked certificates received from the CA on the last CRL update, got a 'good' reply to the OCSP request and so on).
Jan
24
answered SSL Certificate revocation check
Jan
20
awarded  Nice Answer
Jan
6
awarded  Critic