Reputation
522
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 9
Impact
~13k people reached

  • 0 posts edited
  • 0 helpful flags
  • 23 votes cast
2d
comment Why are self signed certificates not trusted and is there a way to make them trusted?
@kubanczyk - He could get his server certificate trusted by the browser by putting it directly in the trust store, by putting the IA certificate in, or by putting the CA certificate in. Typically, he'd want to put the CA in, but the trust store doesn't have to be only self-signed certificates; with cross-signing, certificates can be both self-signed roots and signed by another certificate.
2d
comment Relative merits of Heimdal and MIT Kerberos?
On the other hand, MIT still has regular releases, Heimdal's last public one was 2012 - cf. h5l.org/releases.html web.mit.edu/kerberos
2d
awarded  Popular Question
Oct
1
comment How to securely send private keys
@DeerHunter there are generally secret keys involved as well, but the starting point is that a secret on the card is known to the provisioner. (Or at least can be derived from the combination of a secret known to the provisioner and public information about the card.)
Oct
1
comment How to securely send private keys
It's common for smart cards to be able to use asymmetric encryption, but be provisioned with keys generated off the device. (Obviously at least the first key has to be protected by something other than asymmetric encryption when there is no existing private key on the card.)
Oct
1
comment How to securely send private keys
An SSL certificate is not really a key pair. You can examine the certificate chain in your browser whenever you connect to a server using SSL, but, obviously, not the private key. However, phrases like "generate a certificate" are often used sloppily to mean "generate a key pair and sign a certificate request".
Aug
14
comment Preventing Ethernet over power
(Cameras just monitoring the door so that if anything unwanted is later found you can check who might have left it are a lot cheaper than a guard though. Unless Tom Cruise is dangling from your air vents to avoid the door and cameras.)
Aug
14
comment Preventing Ethernet over power
Though you then have the problem that if whatever is in the room is classified, anyone monitoring a live feed from the cameras has to be cleared to see anything that might become visible, and the feed is another thing that penetrates the room boundary to worry about. Recording cameras where the recording can be viewed inside the room (or some other secure location) if something needs to be reviewed later are another option, but don't help at the time. If it really has to be this secure, the OP probably isn't allowed to give details.
Aug
12
comment Preventing Ethernet over power
That's why I said "Obviously you can combine this with filters on the power line" :-)
Aug
12
comment Preventing Ethernet over power
(Of course it also assumes/requires that authorised users of the room will tolerate that sort of treatment.)
Aug
12
answered Preventing Ethernet over power
Jul
21
awarded  Caucus
Apr
15
comment Why does the user pick the password?
@Vality - that's not entirely true. If I pick a weak password on a web service, anyone in the world can try and guess it. If I use a strong password and write it on a post-it note on my monitor at work, a very small number of people I generally have to trust anyway have access to it. If I write it down in a password manager application that's protected by a password I don't write down, it's even harder for anyone else to access.
Mar
26
comment Hide the fact of e-mail communication
@vojta - I think that "when not overcoming any obstacles" is a spurious qualification, and that the UK's Computer Misuse Act 1990 doesn't say anything about overcoming obstacles to gain unauthorised access anyway. There are situations where Eve might have authorised access to all the potential girlfriend's mail and is merely abusing it, but it's unlikely.
Mar
25
comment Hide the fact of e-mail communication
I know you said divorce is not an answer, but Eve monitoring Alice's mail (and all the other potential girlfriends) is almost certainly a criminal offence. Bob can probably use that as justification for a divorce, and once Alice is in jail she can't monitor Bob any more.
Mar
25
comment Hide the fact of e-mail communication
@sebleblanc But with the problem as stated, Alice will start suspecting Bob is married if he stops using the email address she (and Alice) already know as Bob's. Even if her boss is also called Bob, the pseudonym is going to be hard to pull off without Eve actively co-operating.
Mar
20
comment Can an old operating system webserver be made secure?
He could run a user-space TCP stack and ignore the OS one completely, at least in theory....
Mar
18
comment Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?
Sorry, I don't have any suggestions. But at least you now have an existence proof that a PKCS#11 implementation can allow unbounded private key export, only protected with an externally provided AES key, with a FIPS 140-2 level 3 HSM.
Mar
18
answered Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?
Mar
13
comment Is it legal to start a private website for you and your friends to hack?
As well as the free level of CTF365, you could try microcorruption.com/about (and/or forthcoming kalzumeus.com/2015/03/09/announcing-starfighter)