4,268 reputation
1225
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 7 months
seen 2 days ago

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


Dec
31
answered Public key authentication: what gets signed?
Dec
31
comment Is there a secure PGP signed blogging service
While resource requests are off-topic on Stack Exchange, I think this question is probably okay if it's understood as, "What kind of scheme would make this possible, and has it been implemented anywhere?"
Dec
23
revised What are the dangers of allowing “less secure apps” to access my Google account?
added 170 characters in body
Dec
18
awarded  Nice Answer
Dec
17
revised Why not use symmetric encryption?
added 98 characters in body
Dec
17
revised Why not use symmetric encryption?
added 22 characters in body
Dec
17
answered Why not use symmetric encryption?
Dec
8
revised Long passwords and key derivation functions
added 427 characters in body
Dec
8
answered Long passwords and key derivation functions
Dec
8
comment Why are CSRF tokens used so often?
@PaulDraper Strictly speaking, I think if you treat a lack of origin as a failed origin-match, a CSRF attack can't break your security, but your website may still break (i.e., fail to function normally for browsers that never send Origin headers) without an attack. An attack doesn't break your site; the browser's failure to send an Origin header breaks your site. That's obviously not great site design, but that's only reading of "rules that CSRF exploits can never break" I can think of that is strictly correct.
Dec
1
comment MITM faking certificates
"what will [the server] check to ensure I am a legitimate 3DS?" By definition, if the 3DS doesn't use TLS mutual authentication, the server does not validate the client. If the server does validate the identity of the client, then you are using mutual authentication. Without mutual authn, it's still possible to make the messages only usable by a 3DS by, e.g., transmitting messages in a proprietary binary format, or only transmitting encrypted data, decrypted by a secret decryption key printed into the 3DS hardware.
Dec
1
comment MITM faking certificates
"the Nintendo server is expecting to see the original 3DS public certificate" Does the 3DS connection use mutual authentication? If not, the server's public key is public, and the server normally should give it to you (assuming you're using TLS; maybe you're not?).
Nov
16
awarded  Revival
Nov
11
comment How to be sure that downloaded file is correct?
@nikitablack Sure, a malware author could sign a virus with any private signing certificate that he has. The benefit of a signature is knowing who signed it. If you download a file from "Good Guys, Inc." but the file is signed by "Mysterious Suspicious Corp.", you know the file didn't come from Good Guys, Inc. It seems pretty dumb to sign your malware, though: after a few reports, Windows (or the CA) will send around an update not to open files signed by Mysterious Corp. (Of course, if someone steals the private signing key from Good Guys, Inc., that's an entirely different matter...)
Nov
11
awarded  Good Answer
Nov
10
awarded  Mortarboard
Nov
10
revised How to be sure that downloaded file is correct?
added 43 characters in body
Nov
10
answered How to be sure that downloaded file is correct?
Nov
10
awarded  Nice Answer
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited to add one final attempt at explanation, where we consider a single flipped bit, changed by honest mistake by the ISP.