233 reputation
16
bio website
location
age
visits member for 2 years, 5 months
seen 4 hours ago

May
8
awarded  Scholar
May
8
accepted How much of a certificate is actually covered by the CA's signature?
May
8
awarded  Commentator
May
8
comment How much of a certificate is actually covered by the CA's signature?
@NeilSmithline - My nomenclature may be letting me down here. The command was openssl pkcs12 -export -aes256 -CSP "Microsoft Enhanced RSA and AES Cryptographic Provider" -inkey priv.pem -in pub.crt -out priv.pfx, where the -CSP parameter was pertinent to what I needed to do. I am not technically sure if that means I changed the private key, the certificate or neither.
May
8
comment How much of a certificate is actually covered by the CA's signature?
Does that mean that the Crypto Service Provider is part of the container, rather than the certificate? If so, what other common tuples are specific to the container, rather than the certificate?
May
7
asked How much of a certificate is actually covered by the CA's signature?
Jul
23
asked How long do HTML password fields (sent to the server as postdata) remain in memory?
Dec
6
awarded  Yearling
Apr
11
asked BEAST mitigation on a Cisco ACE 4710 load balancer
Dec
21
comment If someone asks to borrow your phone to make a call, what could they do?
Surely the worst thing is to set off that nuclear weapon where I live, not Manhattan!
Dec
17
answered How to protect server uploads
Dec
17
comment What issues arise from sharing a SSL certificate's private key?
@lynks - might not make sense, but still happens. And there is no reason you couldn't serve www.example.org, secure.example.org, example.org and images.example.org from the same server. Good that it is not limited in this instance, though.
Dec
17
answered BEAST: IIS6: Failing PCI scan - are these ciphers OK?
Dec
14
comment BEAST: IIS6: Failing PCI scan - are these ciphers OK?
I think so, which is why we elected not to fix it (we have a requirement in our app to support IE6/7 still). I think it is acceptable, provided the CBC-based cipher is prioritised such that it will not be chosen over an RC4 implementation -- blogs.msdn.com/b/kaushal/archive/2011/10/03/… has some more details
Dec
14
comment What issues arise from sharing a SSL certificate's private key?
Not necessarily from a security standpoint, but some cert providers charge per-server; if S is cheap, then they probably bought a 1-server cert...
Dec
14
comment BEAST: IIS6: Failing PCI scan - are these ciphers OK?
I think the problem is the DES-CBC3-SHA entry; we had a third-party pen test that said the same and wouldn't go away until we removed anything with CBC in its name.
Dec
14
comment How should I audit and monitor shared TCP ports in Windows?
Can you request that it is reported to your systems by in-app code? stackoverflow.com/questions/93162/…
Dec
10
revised Ordering of shared Phase 1/ISAKMP VPN policies
deleted 26 characters in body
Dec
10
revised Ordering of shared Phase 1/ISAKMP VPN policies
added possible solution
Dec
6
awarded  Editor