2,609 reputation
611
bio website
location Ireland
age
visits member for 1 year, 3 months
seen 2 days ago

Apr
12
answered When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this?
Apr
9
answered Is a mongodb build that uses the -ssl option vulnerable to heartbleed?
Apr
3
revised What's an easy way to perform a man-in-the-middle attack on SSL?
add sslsplit, minor clean ups
Apr
1
answered can a x.509 certificate alone be used for user authentication?
Mar
30
awarded  Enlightened
Mar
30
awarded  Nice Answer
Mar
29
revised How can SSL vendors limit the amount of servers they can be installed on?
added 946 characters in body
Mar
29
answered How can SSL vendors limit the amount of servers they can be installed on?
Mar
24
comment Malicious code in image. Harmful?
See security.stackexchange.com/questions/32852/… , security.stackexchange.com/questions/32967/… and security.stackexchange.com/questions/3919/…
Mar
13
answered What's the use of certificate on Load Balancer and Keystore on Service?
Mar
12
answered Is STARTTLS a security-vulnerability?
Feb
28
awarded  Custodian
Feb
28
reviewed Approve suggested edit on How weak is MD5 as a password hashing function ?
Feb
28
comment Yahoo Account hacked, changed pw, spam still going out elsewhere?
Yahoo tend to use DKIM (though they don't definitively state all email does, and publishing DKIM policy is still somewhat messy). If the DKIM signature checks out, then you can be certain it originated within Yahoo, if there is no DKIM-Signature: header then it's a good indicator it did not.
Feb
27
comment What are the vulnerabilities of using a 256 bit encrypted PDF file over email?
Correction to the above: there is/was an issue with AES-256 (Acrobat 9/PDF 1.7, Extension Level 3): it used only a single SHA-256 operation. See pdflib.com/knowledge-base/pdf-security/encryption fixed in later versions ("extensions").
Feb
27
comment What are the vulnerabilities of using a 256 bit encrypted PDF file over email?
PDF has a key derivation function, a password is not used directly for a key. The main features are 256-bit padding, inclusion of file-specific identifiers (effectively salt, though not necessarily crypto-quality randomness), and 50-iteration MD5. See §3.5.2 of the PDF 1.7 Reference(warning: 1300+ page PDF). It's no PBKDF2, but it's something of a speedbump for dictionary attacks.
Feb
26
comment 2-Factor Auth with SSH
The google-authenticator PAM module works fine with OpenSSH, it's self-contained (no Google servers involved). If you're using it with a TOTP token though, note it has a hard-coded timestep of 30s which may need to be modified (some use 60s).
Feb
18
answered Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?
Feb
5
comment Citation Needed for FIPS Anecdote Regarding MD5 and RC4
The IG has undergone substantial revision since this answer was written, the current IG (2014-01-17, page 32) says of MD5: May be allowed in an Approved mode of operation when used as part of an approved key transport scheme e.g. SSL v3.1) where no security is provided by the algorithm. So it's still hanging in there.
Jan
31
revised why are the first few characters of a DSA Private Key similar?
typo/grammar