Reputation
497
Top tag
Next privilege 500 Rep.
Access review queues
Badges
5 17
Impact
~14k people reached

Dec
17
comment How to replace SSL/TLS?
Are we talking about a web server that will serve web pages? Or a server for something else? (Maybe a Node.js server for a desktop game)
Oct
29
comment Why does IE11 refuse to enable back navigation caching for HTTPS?
"Normal caching": When you load a page (by for example typing an address in the address bar), the HTML is downloaded. If the HTML references resources that have already been downloaded and exist in the cache, it may not be downloaded again. This can be configured with headers like Cache-Control and Last-Modified. This works for both HTTP and HTTPS.
Oct
29
comment Why does IE11 refuse to enable back navigation caching for HTTPS?
There are two different types of cache: 1) the back navigation cache in IE11 which this question is about 2) normal caching which all browsers do. The article is about (1). The question is about (1). Normal caching (2) does happen in HTTPS.
Oct
29
comment Why does IE11 refuse to enable back navigation caching for HTTPS?
And yet, normal resource caching is enabled for HTTPS! Why is IE11 so concerned about physical access when it comes to back navigation caching, but not when it comes to normal caching?
Oct
1
comment How can CloudFlare provide a valid SSL certificate for domains not under its control?
I understand that you can't use your own certificate with the free plan. My question is why does the free plan even work: why do certificate authorities validate CloudFlare free certificates? I can't upvote your answer for this reason but thanks for participating :)
Sep
18
comment Can I use 2 factor authentication for shared accounts?
That makes sense. 2FA is supposed to represent something you own. So if you want to share it, you have to share the physical phone or fob or whatever it is among several people at the office.
Jul
7
comment How does malicious software encrypt victims' files?
This is a bit off-topic but there's loads of software on Linux that looks at file extensions and does not look at file headers.
Jun
24
comment Why is the same origin policy so important?
Why didn't browser vendors choose this solution: if a.com makes a request to a resource from facebook.com, that request is made without any cookies, that way facebook.com will treat it as unauthenticated. Doesn't that close the vulnerability without banning cross-origin requests?
Jan
22
comment How can I encrypt a file using gpg without including the recipient's key ID?
You, sir/ma'am, are a genius. I can't believe I didn't spot this.
Dec
10
comment How can I encrypt a file using gpg without including the recipient's key ID?
Isn't there a way using PGP that you can publicly distribute your public keys, while hiding who the intended recipient is of an encrypted message? I don't see a reason why this couldn't be possible in theory. Why doesn't GPG simply omit the recipient's key ID in plain-text in the created encrypted message?
Dec
10
comment How can I encrypt a file using gpg without including the recipient's key ID?
Thanks for your answer. I've edited the question to make it clear that I don't want any information about the recipient or the sender to leak. If an attacker found the encrypted message on a USB stick, they should not gain any information from it.
Dec
9
comment How can I encrypt a file using gpg without including the recipient's key ID?
How would the recipient distribute the public key to to the sender without making it known to the attacker? Public keys are meant to be publicly distributed.
Dec
8
comment Lessons learned and misconceptions regarding encryption and cryptology
PGP does not use the same key pair for signing and encryption. Rather, a PGP private key is composed of a main key, used for signing, and one or more subkeys, used for encryption. The subkeys are hidden from the user, hence the confusion, but you can view them using gpg --list-secret-keys.
Dec
8
comment Can all the (other) recepients of a PGP encrypted message be identified?
See also: security.stackexchange.com/q/25170/15712