Reputation
1,322
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
3 16 31
Newest
 Announcer
Impact
~105k people reached

Apr
19
comment How secure are the FIDO U2F tokens
@tylerl, Btw, do you mean to say that you don't work on the security branch of Google, or do you mean to say that you work on the security branch, but not specifically on the u2f branch?
Apr
18
comment How secure are the FIDO U2F tokens
@tylerl, How does this solution match up with RSA's SecurID cnet.com/news/rsa-cyberattack-could-put-customers-at-risk
Apr
18
comment How secure are the FIDO U2F tokens
@grawity, Recently they're trying to remake TLS too, thus the present TLS vulnerabilities are not inherent and can be fixed in the future. While hardware tokens can be more secure and can make sense in "high-stakes" situations, it isn't convincing that it is a feasible solution, nor a feasible alternative, in general for the masses.
Apr
15
comment What is SHA-3 and why did we change it?
@PaŭloEbermann, Finally we have someone talking some sense here.
Apr
15
comment What is SHA-3 and why did we change it?
@ThomasPornin, Re "SHA-2 turned out to be more robust than expected"; What was the expectation? For it to last 3 years? Re "Let's not be hasty"; it's been almost half a decade now, do you consider Keccak stabler than SHA2?
Apr
13
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@curiousguy, Which CA would you have chosen? GeoTrust, the one google uses?
Apr
13
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@WoJ, Btw any disclaimers? Are you a staff or "interested party"?
Apr
12
comment Why would Chrome not display a padlock icon at all on an SSL site?
@MichaelStum, You aren't the user of Chrome, your website visitors are. These padlock stuff are not the for website creators, but for the website readers.
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@Pancho, How does this so-called "warranty" work anyway? This doesn't make sense. See security.stackexchange.com/questions/18666/… . 1.5 million per user multiplied by 850k users would already cost you 12 trillion dollars.
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
When push comes to shove I wonder if it's even possible to actually collect the $1.5 million USD warranty. How would this "warranty" work if 300k customers all start claiming for it?
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@DamianYerrick, How many users does Comodo Dragon have anyway?
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@R. This answer is misleading and wrong because the user himself could have checked your certificate chain from the browser UI if he wants to. So if buy get a better chain, your user would know that and hence allocate more "trust" to it. (Assuming they know how to of course...)
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@RоryMcCune, I'd go as far as to say almost no users would know how to check the issuer.
Apr
12
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
@Tim, Are there even CAs that sell 4096 bit certs?
Apr
12
comment 4096 bit RSA encryption keys vs 2048
@AndrewLott, How did you find that from?
Apr
12
comment 4096 bit RSA encryption keys vs 2048
Also see stackoverflow.com/a/589850/632951 and security.stackexchange.com/a/1755/2379 regarding this.
Apr
12
comment Why most people use 256 bit encryption instead of 128 bit?
There's a near duplicate post on crypto.stackexchange.com/q/20/2373
Apr
12
comment Does Google use extended validation certificates?
Related: security.stackexchange.com/questions/13453/…
Apr
12
comment Are all SSL Certificates equal?
@Bruno, From their collective profits, we can see that the confusopoly is working very well indeed. This kind of double-language ambiguity and lack of consistency gives the CAs a lot of plausible deniability. At least those CAs founded/controlled by real coders/developers will try to justify their stance with some information and data, for example certsimple.com/blog/domain-validated-ssl-google-com-mg
Apr
12
comment Are all SSL Certificates equal?
@Bruno, All CAs imply that DV is crap stuff only used by amateurs, OV is "so-so", and EV is what the big boys use. I've seen about 20 CAs implying this already. It always starts with the harmless phrasing "Level 1, 2, 3" and double-meaning phrases like "provide the lowest level of validation". Digicert, in an attempt to brainwash the world into spending more money on certs, jumped the shark by refusing to allow DV registrations for the reason "we believe that the drawbacks of issuing domain validated certificates far outweigh the benefits".