2,021 reputation
416
bio website netrek-apsillers.rhcloud.com
location United States
age 25
visits member for 1 years, 7 months
seen Apr 12 at 20:06

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Aug
3
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan The problem case here isn't with a new IP address. The problem is a new server accessed through a repeat IP. (For example, Amazon assigns your first VM some IP; after you destroy it, a future VM you create may be given the same IP address, but the new VM will have a new keypair.)
Jul
27
revised Encryption algorithm encryptable by md5 of key and decryptable by key
added 492 characters in body
Jul
27
answered Encryption algorithm encryptable by md5 of key and decryptable by key
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Yes, but your server also has its own public key that you use to send it messages. The server stores your public key in authorized_keys to verify your identity, and you store a fingerprint of the server's public (in your laptop's ~/.ssh/known_hosts) key to verify the server. See also What is the difference between authorized_key and known_host file for SSH?
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Yes, correct -- that is the entire point of encryption. You can freely distribute your public key (that's why it's called a public key). The public key only allows someone to send messages to you (not as you, nor as anyone else).
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
If GOOD doesn't have a keypair, then A can't send encrypted messages to GOOD. In an asymmetric key system, the recipient of encrypted messages must have a private key (and then senders use the associated public key to send messages). A's public key is used for encrypting messages intended for A (i.e., to be decrypted by A's private key). To have two-way communication and authentication, you need a keypair for each party.
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
When A connects to GOOD, he uses GOOD's public key to encrypt his messages to GOOD. If BAD intercepts encrypted message intended for GOOD, BAD can't read them, because of the encryption. Assuming A already knows GOOD's public key, he will not use BAD's public key by mistake when trying to talk to GOOD (or if he does, the system will give him a stern warning that it's a bad idea). Thus, A's outgoing messages will be encrypted with GOOD's public key, and messages from GOOD to A are encrypted with A's public key.
Jul
26
revised In which ways could a javascript making a cross domain HEAD request be a threat?
added 413 characters in body
Jul
26
revised In which ways could a javascript making a cross domain HEAD request be a threat?
added 413 characters in body
Jul
26
revised In which ways could a javascript making a cross domain HEAD request be a threat?
added 2 characters in body
Jul
26
revised In which ways could a javascript making a cross domain HEAD request be a threat?
added 233 characters in body
Jul
26
answered In which ways could a javascript making a cross domain HEAD request be a threat?
Jul
26
comment In which ways could a javascript making a cross domain HEAD request be a threat?
@Iain, are you concerned that HEAD is not treated as a simple request verb? Point #1 in the answer you quote is actually incomplete; the simple request verbs include GET, POST, and HEAD.
Jul
24
comment BitMessage : Key authentication?
@Kheil I read the BitMessage paper more thoroughly I've made another edit. I looks like what you want (address-to-person authentication) is not part of BitMessage, because the original author assumed a threat model in which users would not want to have their address linked to their real identities. However, such a system (if it were implemented) would not be incompatible with BitMessage, since "sending an encrypted message" and "verifying the real owner of an address" are orthogonal operations.
Jul
24
revised BitMessage : Key authentication?
added 1146 characters in body
Jul
24
comment How to know if mail is for tracking our IP
IP is sent at layer 3 (network layer) and is necessary to receive a response from the server. Tamper Data alters layer 7 HTTP headers.
Jul
23
comment BitMessage : Key authentication?
@Kheil Right, with PGP, users cryptographically sign statements like, "I assert that Bob Roberts has a public key with the fingerprint XXXXXX." As far as I can tell, Bitmessage has no similar web of trust mechanism. (Maybe one could be deployed?) I look forward to any other answers addressing the topic.
Jul
23
revised BitMessage : Key authentication?
added 73 characters in body
Jul
23
revised BitMessage : Key authentication?
added 73 characters in body
Jul
23
answered BitMessage : Key authentication?