449 reputation
17
bio website chiark.greenend.org.uk/~armb
location Cambridge, UK
age 49
visits member for 1 year, 2 months
seen Apr 16 at 14:50

Mar
26
comment How to securely share key between two remote devices?
For using standard per user CA signed client certificates, see developer.android.com/training/articles/… nelenkov.blogspot.co.uk/2011/11/using-ics-keychain-api.html
Mar
26
comment How to securely share key between two remote devices?
Actually it might not be necessary that each client have its own certificate. You can build a fixed private key and its associated certificate into the application, and that's sufficient for the server to be able to authenticate that a registration request is coming from a copy of the client (or that someone has reverse engineered the client). Depending on your registration scheme, you may be able to use that to bootstrap per-client certificates.
Mar
21
comment How can you prevent employees of your company from creating valid ssl certs?
As an aside, just an email address is enough to get a client SSL certificate, but it will be for that specific address, not the domain.
Jan
31
awarded  Yearling
Jan
14
comment Relative merits of Heimdal and MIT Kerberos?
True, it's not completely freely exportable, just much much more so than in the 1990s. en.wikipedia.org/wiki/… en.wikipedia.org/wiki/… The still embargoed countries are (I think) Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria (though also I've seen lists which omit Iraq ans Libya - the US government page cited is 404 and I haven't bothered to track down where it moved to) cryptolaw.org/cls2.htm#us_terror
Sep
16
comment How can I know that the CA certificates in my computer have not been spoofed?
Something I didn't mention and should have - if your browser has been replaced by a patched copy, the list of root certificates it displays might not be the real list it effectively uses internally. And the certificate it displays when you say "show me details of the current connection" might not be the real one. If you aren't allowed to install new software, even inside a VM, nor run portable software from e.g. a USB memory stick, there's not much you can do about that. That's going further than the scenario in your original question though.
Sep
12
comment How can I know that the CA certificates in my computer have not been spoofed?
(Also, to a first approximation, OCSP doesn't work: imperialviolet.org/2011/03/18/revocation.html)
Sep
10
answered Relative merits of Heimdal and MIT Kerberos?
Sep
4
comment What is certificate pinning?
Fuller details of how it's done (or how it might be done when draft proposals are standardised): owasp.org/index.php/Certificate_and_Public_Key_Pinning tools.ietf.org/html/draft-ietf-websec-key-pinning tack.io/index.html imperialviolet.org/2011/05/04/pinning.html
Aug
22
revised How can I know that the CA certificates in my computer have not been spoofed?
Add certificate pinning/DANE
Aug
22
comment How can I know that the CA certificates in my computer have not been spoofed?
If someone has inserted a root CA, then it will point at an OCSP server they control.
Aug
21
answered How can I know that the CA certificates in my computer have not been spoofed?
Aug
16
awarded  Student
Aug
16
asked Relative merits of Heimdal and MIT Kerberos?
Jun
12
comment Is it legal to find bugs on a website and report them to the website's owner?
See troyhunt.com/2012/07/lessons-in-website-security-anti.html for an example inept response: "Let me assure you that all customer passwords are stored securely & in line with industry standards across online retailers." Also bbc.co.uk/news/technology-19316825
Jun
10
comment I'm an IT consultant. Should I discourage a client from telling me his password?
There is still potentially some value to not knowing the password. In the worst case, if child pornography is found on the client's laptop, downloaded after you gave it back, and the police ask who else might have put it there, yes you could still have installed a software keylogger and remote access tools, logged into his account, downloaded the porn, and cleaned up the keylogger etc. afterwards, but it's probably still better not to have known his password. So the trust issue potentially goes both ways. That's a fairly unlikely scenario though.
Jun
7
awarded  Nice Answer
Jun
7
comment I'm an IT consultant. Should I discourage a client from telling me his password?
If I asked an IT consultant to do some work on my laptop, I'd expect to pay for it.
Jun
7
answered I'm an IT consultant. Should I discourage a client from telling me his password?
May
8
comment How can I implement authentication in my proxy server?
StackExchange is suggesting I automatically move this to chat, but then says you don't have enough reputation for me to do that. But "extended discussions in comments" point taken. Maybe I should delete my comments and just ask for more details of what you are trying to do. My experience is that if you configure your browser to use a proxy, the address bar just works (though at least in the case of Websense, the content can be silently screwed up if configuration is wrong). This might mean you need someone with more experience, who can actually answer instead of asking questions in comments.