Reputation
5,265
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
14 24
Newest
 Nice Answer
Impact
~342k people reached

Feb
17
answered CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow
Feb
16
revised Why is NIST removing & not updating TLS guidance? What is the replacement?
Update, ref SP.800-52r1
Feb
16
revised Why is NIST removing & not updating TLS guidance? What is the replacement?
Update, ref SP.800-52r1
Feb
12
awarded  Nice Answer
Jan
20
revised Does a TLS interception proxy present the user's browser with the end server's certificate?
updates
Jan
10
awarded  Yearling
Jan
6
awarded  Nice Answer
Dec
28
comment Is there any extra validation that Firefox perform to certificates serial number
Firefox also blocks a certificate if it sees a serial number reused by a CA, though that doesn't sound like the problem here.
Dec
27
comment Need to access old forgotten router that only supports SSLv3
3DES (three-key TDEA) as 112-bit equivalent: Qualys have been recommending it be used only for backward compatibility since last year. The three-key form is now the lowest acceptable strength approved by NIST (SP800-131A R1 (PDF)). Whether it might be next on the chopping block is conjecture on my part...
Dec
24
revised Need to access old forgotten router that only supports SSLv3
added 4 characters in body
Dec
24
revised Need to access old forgotten router that only supports SSLv3
added 31 characters in body
Dec
24
revised Need to access old forgotten router that only supports SSLv3
added 31 characters in body
Dec
24
comment Need to access old forgotten router that only supports SSLv3
Risk and effort depend on the nature and number of devices, organisation security policy, and whether you need to restart your browser. A one-line shell script that reduces the "human element" of a risk is a justifiable alternative. (Ignoring the elephant in the room that is best summed up in zxq9's large hammer comment.)
Dec
23
answered Need to access old forgotten router that only supports SSLv3
Dec
14
comment Nikto scan says “Uncommon Header”
FWIW, Nikto reports uncommon header if a header is not in its db_headers file. What's also happening though is that Incapsula are issuing cookies with invalid data that a browser will accept but the bundled LW2 (libwhisker) will not.
Dec
8
comment Is it common practice for companies to MITM HTTPS traffic?
ISO 27001, but in general terms: if you identify this (un-inspectable data) as a risk, you must take action according to your risk treatment plan, and 27002 is typically circumspect (not even using the word "proxy"). An action may be to adopt a default-deny with white-listing, or to MITM/inspect traffic (or both). The Australians are more direct, the ASD ISM control 0263 states exactly those options (there's a short section "Web Content and Connections") on this topic).
Nov
15
awarded  Good Answer
Oct
20
revised Never heard of compiler vulnerabilities when compiling?
spelling & grammar
Oct
20
comment Never heard of compiler vulnerabilities when compiling?
Probably because it's a low-reward/high complexity attack,without a privilege boundary to cross (though it does cross a data-boundary). While it would almost certainly pass unnoticed on inspection, the same could be said about 85kloc configure scripts... (PHP, I'm looking at you)
Aug
7
answered Why is encryption (or signing) of long lines in E-Mails with PGP problematic?