221 reputation
18
bio website
location
age
visits member for 1 year, 7 months
seen Oct 31 '13 at 7:11

Nov
18
comment How are root CAs for SSL distributed?
It is, indeed, funny... turtles all the way down!
Sep
15
comment In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
@tdammers could it conceivably work in a mailinglist-sort of way?
Sep
14
comment Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?
Sorry, I guess I was looking for a little bit more detail. I asked a more thorough version on crypto.SE.C, but I'm now thinking that it may have been an actually less appropriate site for the Q. crypto.stackexchange.com/questions/3796/… If you have priveleges perhaps you'd like to migrate it over.
Sep
14
comment Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?
So you have to be an authorized link in the chain of the networking infrastructure used for the targeted connection, then? You know about ex-parrot.com/pete/upside-down-ternet.html ?
Sep
14
comment In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
I'd just like to double check -- a different K must be used for each message, correct? Thinking it through on my own, I'm almost so sure of this that I don't even want to waste your time with the question, but I would just like to make sure I understand what's going on correctly.
Sep
14
comment In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
Oooh, I especially like the second point. Has anyone ever heard of PGP being used for multi-party mailing lists?
Sep
10
comment Why are CSRF tokens necessary?
@Gumbo that's a great point.
Sep
10
comment Why are CSRF tokens necessary?
I think it's really fantastic how accessible information about security is becoming. Thanks!
Sep
10
comment Why are CSRF tokens necessary?
Well that makes sense then. There really isn't any additional privacy leak to sending same-site referrers, though, and that's really all that's called for here. I believe the browsers that offer a way to disable referer transmission only allow disabling it for external link clicks. Of course there're extensions to both big browsers that disable it completely. But yeah, obviously there'd be a reasonably explanatory error message.
Sep
10
comment Why are CSRF tokens necessary?
I don't think it actually would break BC, if you read the post carefully. Is "nonce" synonymous with "CSRF token"?
Sep
10
comment Why are CSRF tokens necessary?
But what I don't understand is how a replay attack is an attack at all. Seems more like an innocent accident or a bug or a mishap. Also, isn't the risk of that mitigated by disabling / "greying out" the button on it's click event? I read a post about that one time, I think it was on codinghorror. I'd also redirect after the POST receiver script got hit. Finally, how would you verify the nonce when you received it back?
Sep
10
comment Why are CSRF tokens necessary?
I don't believe that the HTTP spec requires referrer transmission. But if one assumes that their users have internal referrer transmission enabled, I assume just verifying that would do the trick too, wouldn't it?