network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 8 months |
| seen | Nov 18 '12 at 7:18 | |
| stats | profile views | 2 |
|
Nov 18 |
comment |
How are root CAs for SSL distributed? It is, indeed, funny... turtles all the way down! |
|
Sep 15 |
comment |
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption? @tdammers could it conceivably work in a mailinglist-sort of way? |
|
Sep 15 |
comment |
Should WPA2-AES be presumed insecure? (What is the “Hole196” vulnerability?) I thought that was pretty useful. |
|
Sep 14 |
comment |
Without SSL, what vantage point does one need to MITM non-SSL'd HTTP? Sorry, I guess I was looking for a little bit more detail. I asked a more thorough version on crypto.SE.C, but I'm now thinking that it may have been an actually less appropriate site for the Q. crypto.stackexchange.com/questions/3796/… If you have priveleges perhaps you'd like to migrate it over. |
|
Sep 14 |
comment |
Without SSL, what vantage point does one need to MITM non-SSL'd HTTP? So you have to be an authorized link in the chain of the networking infrastructure used for the targeted connection, then? You know about ex-parrot.com/pete/upside-down-ternet.html ? |
|
Sep 14 |
comment |
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption? I'd just like to double check -- a different K must be used for each message, correct? Thinking it through on my own, I'm almost so sure of this that I don't even want to waste your time with the question, but I would just like to make sure I understand what's going on correctly. |
|
Sep 14 |
comment |
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption? Oooh, I especially like the second point. Has anyone ever heard of PGP being used for multi-party mailing lists? |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? @Gumbo that's a great point. |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? I think it's really fantastic how accessible information about security is becoming. Thanks! |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? Well that makes sense then. There really isn't any additional privacy leak to sending same-site referrers, though, and that's really all that's called for here. I believe the browsers that offer a way to disable referer transmission only allow disabling it for external link clicks. Of course there're extensions to both big browsers that disable it completely. But yeah, obviously there'd be a reasonably explanatory error message. |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? I don't think it actually would break BC, if you read the post carefully. Is "nonce" synonymous with "CSRF token"? |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? But what I don't understand is how a replay attack is an attack at all. Seems more like an innocent accident or a bug or a mishap. Also, isn't the risk of that mitigated by disabling / "greying out" the button on it's click event? I read a post about that one time, I think it was on codinghorror. I'd also redirect after the POST receiver script got hit. Finally, how would you verify the nonce when you received it back? |
|
Sep 10 |
comment |
Why are CSRF tokens necessary? I don't believe that the HTTP spec requires referrer transmission. But if one assumes that their users have internal referrer transmission enabled, I assume just verifying that would do the trick too, wouldn't it? |
