Reputation
604
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 20
Newest
 Yearling
Impact
~20k people reached

Apr
27
awarded  Yearling
Feb
24
comment What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
are you saying that the outer ID goes as part of the encrypted request in addition to being exchanged in the original non-encrypted request?
Feb
23
comment What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
Oh, so, this is what the outer identity field is? Doesn't it mean that anyone can pretend to be me by supplying the outer identity of myself? Does the outer identity gets checked by the Home RADIUS? How would the Access Point institution go about finding the actual identity of the user, then?
Feb
23
asked What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
Feb
22
asked How do the eduroam WPA-Enterprise 802.1X certificates look like?
Feb
16
comment Protection of eduroam credentials
Regarding 3., I think you're missing the fact that the credentials are used as part of WPA-Enterprise, and not at an external web-site, so how is one supposed to ensure any kind of https?! uwaterloo.ca/information-systems-technology/services/eduroam/…
Feb
16
comment Obtain credentials by spoofing WPA/WPA2 Enterprise network?
This is an interesting question, especially its implication to eduroam.
Feb
16
comment Obtain credentials by spoofing WPA/WPA2 Enterprise network?
This is an interesting answer, but it doesn't appear to cover things like eduroam at all, where you don't physically have any direct connection with the on-premises network
Feb
16
answered Protection of eduroam credentials
Feb
16
comment What are the difference between WPA2-PSK and WPA2-EAP-PSK?
@YLearn, that's quite some more useful details than what you have in your answer!
Feb
16
comment What are the difference between WPA2-PSK and WPA2-EAP-PSK?
@YLearn, if it's all one password for all clients, what's really the point of having a whole RADIUS server to authenticate with just a single password?!
Feb
1
comment Can browsers connect HTTPS w/ the NONE cipher?
Cool! Can you provide more details? You mention that it is disabled by default in Opera -- how did you enable it? (Feel free to post screenshots.) Can you also provide more details about the anonymous ciphers, too, for no authentication?
Jan
31
asked Can browsers connect HTTPS w/ the NONE cipher?
Jan
5
awarded  Notable Question
Dec
12
answered What is the community doing for supporting downgrading TLS?
Dec
12
comment What is the community doing for supporting downgrading TLS?
@NeilSmithline, I've clarified the question, and removed the duplicate link
Dec
12
revised What is the community doing for supporting downgrading TLS?
clarify the last sentence and remove the erroneous link in Russian
Dec
12
comment What's the best practice for MitM'ing https traffic to distinguish self-signed certs?
The link you provide doesn't support your rhetoric -- people basically say that CAcert is not any more or less trustworthy than any of the other CAs.
Dec
12
comment What's the best practice for MitM'ing https traffic to distinguish self-signed certs?
To have the record straight, the only reason it was removed from OpenBSD was because CAcert's root certificate apparently didn't have a free licence!
Dec
12
comment What's the best practice for MitM'ing https traffic to distinguish self-signed certs?
A lot of sites do use https with certs by CAcert, which is not generally trusted, for example, undeadly.org, part of the OpenBSD community; outright blocking all such sites surely wouldn't be ideal.