Reputation
866
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 15
Newest
 Caucus
Impact
~77k people reached

Jul
13
awarded  Caucus
Jun
11
comment What can I do to rely less on certificate authorities?
it could also have serials and hashes of actual known certificates. No CA root certificates needed. Of course some trust is still implied even in that case.
Jun
10
comment What can I do to rely less on certificate authorities?
Does the OP miss the idea of the CA? If you terminate the SSL locally on a proxy and then encrypt it again using certs signed with your own (trusted) CA it would at least allow to filter the upstream certs/hosts/CAs that we accept. So if this is intended to work around too trusting browsers/OS, it could have merit. I.e. something like "certificate patrol" but as a proxy. Oh and of course one could check by other properties like the serial number of the certificate (similar to what certificate patrol allows).
Jun
10
comment How can a font be used for privilege escalation?
Uhm, actually with the switch to Windows NT 4 a lot of the GDI responsibilities ended up in kernel mode. This is still the case even for today's Windows versions. The reason is that context switches between kernel and user mode can be pretty expensive. Hence: technically it is needed. One can argue about the pros and cons, but the fact remains that this job is done in kernel mode for a reason.
May
5
awarded  Yearling
Apr
18
accepted How trustworthy is SELinux?
Apr
18
awarded  Nice Question
Feb
27
comment What are the benefits and drawbacks of the HTML5 Keygen element?
do you know of a way to ensure or see that a generated private key doesn't leave my machine in such a process?
Feb
27
comment Making the Firefox key and CSR creation process transparent
@StackzOfZtuff: there you go
Feb
26
asked Making the Firefox key and CSR creation process transparent
Jan
12
awarded  Nice Answer
Oct
8
comment Is there a short command to test if my server is secure against the shellshock bash bug?
@chepner: why? There's a difference between the version reported by the program and the package version. Well, there can be, let's put it this way.
Aug
5
comment Attaching the same file to two separate email, does it compromise security of the “message”
I'm pretty certain that GnuPG doesn't use IDEA, because of patent issues ;)
Aug
5
accepted Attaching the same file to two separate email, does it compromise security of the “message”
Aug
5
comment Attaching the same file to two separate email, does it compromise security of the “message”
Thank you. Together with the linked answer this does seem to answer my question.
Aug
5
asked Attaching the same file to two separate email, does it compromise security of the “message”
Aug
3
awarded  Yearling
Jul
17
comment I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
@SargeBorsch: admittedly. And I agree about full-disk encryption. Assuming it's secure. Depends on your own level of (un)healthy paranoia. FDE also gets rid of the SSD problem mentioned before.
Jul
17
comment I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
@SargeBorsch: not that I know. That's similar to the problem of asking for proof of the existence of a deity, though. The most important point in the comment is that the probability values given hold for a single bit. You need 8 for a single byte and if you know what that means to the overall probability you will not want to look into the range of Mebibytes anymore. There once existed "The Great Zero Challenge" which wasn't accepted. Of course we could come up with a conspiracy theory as to why. AFAIR the old method was to extract "shadows" of the data between tracks on a disk.
May
31
comment Should statically-linked server binaries (daemons) be deemed more secure?
gotcha, thanks for the feedback.