Reputation
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 19
Impact
~20k people reached

Aug
4
awarded  Notable Question
Jul
25
awarded  Constituent
Jul
19
asked Is there an iframe attack surface to webcache.googleusercontent.com?
Jul
14
awarded  Caucus
Jun
5
awarded  Popular Question
May
24
asked Shouldn't DNSCurve be parallel to DNSSEC at root level for diversity?
May
24
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
well, basically, for DNSCurve to work, you have to run a DNSCurve-enabled resolvers from the top; since noone's going to stop running bind, and DNSCurve is unlikely to make it into BIND, it's not like you can get away without running the DNSCurve-aware authentic resolvers in parallel.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@tylerl, what do you mean there's no chain of trust? what's to prevent you from providing nameserver names in the root zone files etc.
May
23
comment If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
@tylerl, regarding your "VPN to your server" comment, it sounds like you're thinking DNSCrypt, which is merely an application of DNSCurve; DNSCurve by itself, if you're running a recursive resolver, does in fact guarantee the integrity of the conversation
May
22
comment Why do banks still hack-up autocomplete=off functionality?
Actually, as per the comment in the other answer, I'd argue the complete opposite -- a computer compromise is clearly the user's fault, whereas phishing is not. "On the other hand, if the user receives an email, asking them to provide a password for the bank, -- that sounds more like the bank's fault for failing to create a policy against such emails, and clearly inform the user of such policy. (And, ironically, it's quite amazing how many times I've received emails from various banks (including PayPal) that, failing a passing header inspection, I'd identify as a phishing attack!)"
May
22
comment Why do banks still hack-up autocomplete=off functionality?
Well, based alone on what you say, I'd argue that if a user's computer is compromised, it's clearly the fault of the user. On the other hand, if the user receives an email, asking them to provide a password for the bank, -- that sounds more like the bank's fault for failing to create a policy against such emails, and clearly inform the user of such policy. (And, ironically, it's quite amazing how many times I've received emails from various banks (including PayPal) that, failing a passing header inspection, I'd identify as a phishing attack!)
May
21
comment Why do banks still hack-up autocomplete=off functionality?
Besides, the credentials used for e.g. credit card access, never have any way to transfer money or do anything "useful" with the account, other than looking at the transaction history. Even new card requests are often protected by the customer being required to provide the CCV number of their physical card.
May
21
comment Why do banks still hack-up autocomplete=off functionality?
by making it harder to store it in the browser means that fishing will be easier; it's a pendulum, why do they swing it only one way?
May
21
asked Why do banks still hack-up autocomplete=off functionality?
May
21
answered Why is GSM still used?
Apr
17
comment Is cacert.org more harmful than self-signing?
@cpast, well, frankly, I just don't trust cacert.org, and I do trust undeadly.org -- I'm willing to bet the likelihood of undeadly.org keeping their certs in a more secure manner than cacert.org is higher. As such, I don't see why you suggest that I should trust a long-term CA root cert, as opposed to a long-term individual cert.
Apr
16
comment Is cacert.org more harmful than self-signing?
@cpast, so, do you suggest it is better to accept the long-term root cert from a third-party CA, than a long-term cert just for the site alone?
Apr
16
comment Is cacert.org more harmful than self-signing?
@cpast, i don't exactly know what they (CA Cert) do, so, i don't know whether or not i trust them (but the fact that they appear to limit people to 6-mo certs conflicts with my beliefs on set-it-and-forget-it approach to things)
Apr
16
revised Is cacert.org more harmful than self-signing?
fix title and clarify that cacert.org was included, but was removed, basically, per cacert's own request!
Apr
16
comment Is cacert.org more harmful than self-signing?
@schroeder, basically, every single time i am to make a new comment?