4,333 reputation
1226
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 8 months
seen yesterday

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


Feb
6
revised Can someone steal cookie contents via a phishing attack?
added 383 characters in body
Feb
6
answered Can someone steal cookie contents via a phishing attack?
Jan
20
awarded  Good Answer
Jan
4
comment Public key authentication: what gets signed?
@shimizu "[generating] a signature by the corresponding private key over the following data" means "signing the following data using the private key that corresponds to the public key being sent." As mentioned above, you don't encrypt with a private key, you sign with a private key. (Also as mentioned above, signing is generally only practical over hashes, not whole data, so you'll really just sign the hash, and send { data, Sign(Hash(data)) }. The recipient can compute Hash(data) and verify that the signature applies to data.)
Dec
31
revised Public key authentication: what gets signed?
added 165 characters in body
Dec
31
answered Public key authentication: what gets signed?
Dec
31
comment Is there a secure PGP signed blogging service
While resource requests are off-topic on Stack Exchange, I think this question is probably okay if it's understood as, "What kind of scheme would make this possible, and has it been implemented anywhere?"
Dec
23
revised What are the dangers of allowing “less secure apps” to access my Google account?
added 170 characters in body
Dec
18
awarded  Nice Answer
Dec
17
revised Why not use symmetric encryption?
added 98 characters in body
Dec
17
revised Why not use symmetric encryption?
added 22 characters in body
Dec
17
answered Why not use symmetric encryption?
Dec
8
revised Long passwords and key derivation functions
added 427 characters in body
Dec
8
answered Long passwords and key derivation functions
Dec
8
comment Why are CSRF tokens used so often?
@PaulDraper Strictly speaking, I think if you treat a lack of origin as a failed origin-match, a CSRF attack can't break your security, but your website may still break (i.e., fail to function normally for browsers that never send Origin headers) without an attack. An attack doesn't break your site; the browser's failure to send an Origin header breaks your site. That's obviously not great site design, but that's only reading of "rules that CSRF exploits can never break" I can think of that is strictly correct.
Dec
1
comment MITM faking certificates
"what will [the server] check to ensure I am a legitimate 3DS?" By definition, if the 3DS doesn't use TLS mutual authentication, the server does not validate the client. If the server does validate the identity of the client, then you are using mutual authentication. Without mutual authn, it's still possible to make the messages only usable by a 3DS by, e.g., transmitting messages in a proprietary binary format, or only transmitting encrypted data, decrypted by a secret decryption key printed into the 3DS hardware.
Dec
1
comment MITM faking certificates
"the Nintendo server is expecting to see the original 3DS public certificate" Does the 3DS connection use mutual authentication? If not, the server's public key is public, and the server normally should give it to you (assuming you're using TLS; maybe you're not?).
Nov
16
awarded  Revival
Nov
11
comment How to be sure that downloaded file is correct?
@nikitablack Sure, a malware author could sign a virus with any private signing certificate that he has. The benefit of a signature is knowing who signed it. If you download a file from "Good Guys, Inc." but the file is signed by "Mysterious Suspicious Corp.", you know the file didn't come from Good Guys, Inc. It seems pretty dumb to sign your malware, though: after a few reports, Windows (or the CA) will send around an update not to open files signed by Mysterious Corp. (Of course, if someone steals the private signing key from Good Guys, Inc., that's an entirely different matter...)
Nov
11
awarded  Good Answer