22,936 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 19 hours ago

Apr
7
reviewed Close Securing single page application
Apr
7
reviewed Close Log Attacks in Different Files using Snort
Apr
7
reviewed Leave Open How can NSA see everything without us noticing that?
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
No problem, sorry it took such a long exchange to figure out what you were asking.
Apr
7
answered Why do I need a certificate to pin an SSL connection with AF Networking 2?
Apr
7
revised Why do I need a certificate to pin an SSL connection with AF Networking 2?
deleted 82 characters in body; edited title
Apr
7
answered Is PCI Compliance mandatory?
Apr
4
revised Server side SSH keys compromised
added 705 characters in body
Apr
4
comment Server side SSH keys compromised
The MITM won't be able to decrypt the real server's portion of the key exchange, so it can't complete the connection with the real server since you need to know both the portion of the session key you generate and the portion of the key that the other system generates and the attacker has no way to get the part the real server generated without the client's private key.
Apr
4
comment Server side SSH keys compromised
@KarolBabioch - to further clarify on the client certificate part (since you don't seem to have understood it from either my answer or Thomas') When using client certificates, the client has a private key that corresponds to the public key given to the server. Unless the MITM is able to intercept the very first time that the client authenticates with the server, the server will already know the public key that corresponds with the client.
Apr
4
revised Server side SSH keys compromised
added 13 characters in body
Apr
4
comment Server side SSH keys compromised
@KarolBabioch - I am saying the same thing as Thomas. An attacker with a private key of the server can not passively attack an existing connection between a client and the real server. (In other words, if the client connects to the correct server when initiating the session, then the false server can't monitor that connection or interrupt it because they don't have the session key.) The client certificate matters because the server will recognize if the client certificate is valid for the user being accessed. The MITM would need to be able to respond to the server's challenge for the user.
Apr
4
reviewed Close SQL Injection via Unicode
Apr
4
reviewed Close Per Vendor/Publisher Device Unique Identifier, How is it and how much secure?
Apr
4
reviewed Close How many bits of entropy should I aim at for my password?
Apr
4
reviewed Close Attack Signatures books
Apr
4
reviewed Leave Open Proving SSL need
Apr
4
reviewed Close How does the Subterfuge toolkit bypass SSL?
Apr
4
reviewed Close What is default mode for AES encryption
Apr
4
answered Server side SSH keys compromised