Reputation
4,749
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
12 22
Newest
 Enlightened
Impact
~247k people reached

Aug
7
answered Why is encryption (or signing) of long lines in E-Mails with PGP problematic?
Aug
6
awarded  Enlightened
Aug
6
awarded  Nice Answer
Aug
6
comment What to do after you get a CVE?
Updated. I believe you just need to wait, posting to oss-sec might help, but it depends on the scope and severity of your issue (and every other issue currently in the queue).
Aug
6
revised What to do after you get a CVE?
added 527 characters in body
Aug
6
answered What to do after you get a CVE?
Jul
27
awarded  Constituent
Jul
22
awarded  Caucus
Jul
15
comment OpenSSL x509: Is there an order in subjectName fields?
dumpasn1 will re-parse the OCTET STRING for you, you need a (seekable file) DER form though: openssl x509 -in facebook-cert.pem.cer -outform DER -out facebook.der; dumpasn1 -tilda facebook.der
Jul
15
comment OpenSSL x509: Is there an order in subjectName fields?
Can you confirm if you mean ordering of the DN (distinguished name) components, or the subjectName in a CSR, or possibly the ordering of the subjectAlternativeName elements?
Jun
26
comment Is there anything I can do about IDN homograph attacks?
Further useful reading in Unicode TR36 Unicode Security Considerations, and in RFC 4290. The latter covers registrar bundling: you don't register a domain as a single label, but a package which can include (or forbid) defined variations on the intended name.
May
28
comment Can attackers get anything with DoS attacks except crashing the service?
For further consideration: a DoS can trigger rate-limiting or simply exhaust logging/audit capacity, this can drop or obscure an attackers source or intent. Some services are also susceptible to various guessing attacks, and DoS-ing all but one server may improve the chances of success, e.g. DNS.
Apr
27
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
You can confirm a change in a private key by a change in the modulus (and possibly exponent) of the certificate. openssl x509 -subject -dates -modulus gives you easier to read output. The -pubkey output is base64 of the DER structure of a sequence of the RSA OID, the modulus and the exponent. (You cannot reliably diff base64 because it is not octet aligned, the addition of a single byte will propagate changes in the output, though it should not vary here, it could vary.)
Mar
24
comment Should I be concerned if my website throws stack information?
CWE-209: Information Exposure Through an Error Message & CWE-756: Missing Custom Error Page.
Mar
13
awarded  Good Answer
Mar
12
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
@YuhongBao thanks, I've expanded the description to include this.
Mar
12
revised In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
added 2333 characters in body
Mar
11
answered Is HTTPS required for PCI Compliance when downloading desktop software patches, if no PII is transmitted, and content is digitally signed + verified?
Mar
4
revised In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
clarifications
Mar
4
answered In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?