Reputation
432
Top tag
Next privilege 500 Rep.
Access review queues
Badges
4 16
Newest
 Yearling
Impact
~13k people reached

Aug
18
comment Why does IE11 refuse to back navigation caching for HTTPS?
I read the entire answer. I could go through it paragraph by paragraph, but it would be quicker to say that I disagree with what you said: "I mean that IE11 does not disable back navigation caching for HTTPS pages." This flat-out contradicts official documentation which I linked to.
Aug
16
comment Why does IE11 refuse to back navigation caching for HTTPS?
IE11 has a brand new cache that is not the application cache for offline access, nor it is the normal HTTP cache, it is a completely new cache called the "back navigation cache". If you look at the linked article, it's clear that this feature is new to IE11 ("Beginning with IE11, webpages that meet specific conditions are cached when the user navigates away."), and it's unlike the usual caches. Also, it's clear from that link that this cache is disabled for HTTPS pages, are you saying that the official documentation is incorrect?
Aug
16
comment Why does IE11 refuse to back navigation caching for HTTPS?
I'm confused by this answer. "No it does not" what? I am definitely not talking about the application cache, I am talking specifically about the back navigation cache for IE11. As far as I know, it doesn't necessarily use the disk for this, it's in RAM. I think this answer is about something I didn't ask about.
Jul
7
comment How does malicious software encrypt victims' files?
This is a bit off-topic but there's loads of software on Linux that looks at file extensions and does not look at file headers.
Jun
24
comment Why is the same origin policy so important?
Why didn't browser vendors choose this solution: if a.com makes a request to a resource from facebook.com, that request is made without any cookies, that way facebook.com will treat it as unauthenticated. Doesn't that close the vulnerability without banning cross-origin requests?
Jan
22
comment How can I encrypt a file using gpg without including the recipient's key ID?
You, sir/ma'am, are a genius. I can't believe I didn't spot this.
Dec
10
comment How can I encrypt a file using gpg without including the recipient's key ID?
Isn't there a way using PGP that you can publicly distribute your public keys, while hiding who the intended recipient is of an encrypted message? I don't see a reason why this couldn't be possible in theory. Why doesn't GPG simply omit the recipient's key ID in plain-text in the created encrypted message?
Dec
10
comment How can I encrypt a file using gpg without including the recipient's key ID?
Thanks for your answer. I've edited the question to make it clear that I don't want any information about the recipient or the sender to leak. If an attacker found the encrypted message on a USB stick, they should not gain any information from it.
Dec
9
comment How can I encrypt a file using gpg without including the recipient's key ID?
How would the recipient distribute the public key to to the sender without making it known to the attacker? Public keys are meant to be publicly distributed.
Dec
8
comment Lessons learned and misconceptions regarding encryption and cryptology
PGP does not use the same key pair for signing and encryption. Rather, a PGP private key is composed of a main key, used for signing, and one or more subkeys, used for encryption. The subkeys are hidden from the user, hence the confusion, but you can view them using gpg --list-secret-keys.
Dec
8
comment Can all the (other) recepients of a PGP encrypted message be identified?
See also: security.stackexchange.com/q/25170/15712