4,534 reputation
1121
bio website
location Ireland
age
visits member for 2 years, 6 months
seen Jul 30 at 15:18

Jul
27
awarded  Constituent
Jul
22
awarded  Caucus
Jul
15
comment OpenSSL x509: Is there an order in subjectName fields?
dumpasn1 will re-parse the OCTET STRING for you, you need a (seekable file) DER form though: openssl x509 -in facebook-cert.pem.cer -outform DER -out facebook.der; dumpasn1 -tilda facebook.der
Jul
15
comment OpenSSL x509: Is there an order in subjectName fields?
Can you confirm if you mean ordering of the DN (distinguished name) components, or the subjectName in a CSR, or possibly the ordering of the subjectAlternativeName elements?
Jun
26
comment Is there anything I can do about IDN homograph attacks?
Further useful reading in Unicode TR36 Unicode Security Considerations, and in RFC 4290. The latter covers registrar bundling: you don't register a domain as a single label, but a package which can include (or forbid) defined variations on the intended name.
May
28
comment Can attackers get anything with DoS attacks except crashing the service?
For further consideration: a DoS can trigger rate-limiting or simply exhaust logging/audit capacity, this can drop or obscure an attackers source or intent. Some services are also susceptible to various guessing attacks, and DoS-ing all but one server may improve the chances of success, e.g. DNS.
Apr
27
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
You can confirm a change in a private key by a change in the modulus (and possibly exponent) of the certificate. openssl x509 -subject -dates -modulus gives you easier to read output. The -pubkey output is base64 of the DER structure of a sequence of the RSA OID, the modulus and the exponent. (You cannot reliably diff base64 because it is not octet aligned, the addition of a single byte will propagate changes in the output, though it should not vary here, it could vary.)
Mar
24
comment Should I be concerned if my website throws stack information?
CWE-209: Information Exposure Through an Error Message & CWE-756: Missing Custom Error Page.
Mar
13
awarded  Good Answer
Mar
12
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
@YuhongBao thanks, I've expanded the description to include this.
Mar
12
revised In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
added 2333 characters in body
Mar
11
answered Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?
Mar
4
revised In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
clarifications
Mar
4
answered In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
Feb
10
comment Can a malware steal the content of the clipboard?
Don't forget the disagreeable Tynt Tracer.
Feb
9
answered SSH raspberry pi security
Feb
2
revised Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?
added 477 characters in body
Jan
29
awarded  Enlightened
Jan
29
revised GHOST: which services are vulnerable, ssh, web server?
added 105 characters in body
Jan
29
awarded  Nice Answer