5,646 reputation
11026
bio website
location
age
visits member for 3 years, 5 months
seen 2 hours ago

Oct
20
comment What's the difference between SSL, TLS, and HTTPS?
@barlop Sorry, it was indeed badly worded, I meant it as "instead of".
Oct
20
revised What's the difference between SSL, TLS, and HTTPS?
added 6 characters in body
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
I suspect you could potentially have a few more if you include international domain names. In addition, your third bullet point ("The "*" must stand for a complete name component" doesn't seem quite right according to RFC 6125, "The client MAY match a presented identifier in which the wildcard character is not the only character of the label".
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
@Arun There might not be theoretical limits regarding the number of SAN entries you can have, but there will certainly be practical ones: they will make the certificate bigger, which will certainly slow down the handshake, or even stop it from completing successfully. I've seen certain TLS stacks "choke" when using certificate_authorities lists (in on a Certificate Request message) that are too long, I would suspect the same would happen with a server certificate that has just become too big.
Oct
17
comment How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?
What reference is "Certificate authority Guideline" exactly?
Sep
30
awarded  Explainer
Sep
27
awarded  Good Answer
Sep
25
awarded  Enlightened
Sep
25
awarded  Nice Answer
Sep
15
comment What are the disadvantages of implementing HTTP authentication in a web application?
@Xander I know, but the title of RFC 2617 is not just "HTTP authentication", but "HTTP Authentication: Basic and Digest Access Authentication". There could be (and there are) other forms of authentication when using HTTP. That's why I was asking for clarification.
Sep
15
comment What are the disadvantages of implementing HTTP authentication in a web application?
Another disadvantage of HTTP Digest (using plain HTTP) compared to either Basic or Digest over HTTPS is that it doesn't protect the rest of the request: a MITM attacker could modify the payload of the request and change its meaning. This can indeed lead to a false sense of security.
Sep
15
comment What are the disadvantages of implementing HTTP authentication in a web application?
You should clarify what you mean by "HTTP authentication" (and what other methods you have in mind).
Sep
15
comment What are the disadvantages of implementing HTTP authentication in a web application?
"With digest access authentication its still necessary to send the password in clear text. However, only one time, at the registration." Actually, that's not true, the server can be set up with the "HA1" part without needing to know the actual password, ever.
Sep
10
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
@BenVoigt I agree 3D-secure only really protects the merchant (although your bank may make you agree with T&C claiming it protects the end-user). The major problem is that the authentication form is served within an iframe, which hides the URL and certificate validation of the 3D-secure page itself. That page often turns out to be some domain that has nothing to do with either the merchant, your bank or the card company. Of course, it's reasonably easy for an unscrupulous merchant site to make that iframe point to any proxy of its choice, which it could control: most users wouldn't notice it.
Sep
3
awarded  Good Answer
Aug
1
comment How do proxy servers protect their SSL certificates?
What you're talking about seems to be a reverse proxy server. They tend to be the web server, as far as the client is concerned, in which case threats to their certificates and private keys aren't really different from other web servers. The fact they're farming out requests to other servers tends to be an operational choice (e.g. for load balancing).
Jul
28
comment TLS WG Charter and Security Goals
@jww Actually you can teach developers to differentiate between good and bad guys. The middleware boxes are typically sanctioned by the institution where the application is going to be deployed. However uncomfortable this may be, the overall user is the good guy (their machines behind that middleware box and the box itself): whoever is in charge of that network should be able to configure the application to trust that box's CA cert. Developers should generally let users choose which CA certs they trust. To differentiate from the bad guys, developers must not bypass certificate verification.
Jul
23
revised Why different key exhange techniques for ssl key exchange?
added 398 characters in body
Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@DanNeely, it doesn't quite change the broader point of this discussion, but that's not how SSL works. Content is encrypted with symmetric keys negotiated during the handshake, not the certificate key.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@ruief, as I was saying in a comment on by SF answer just now, the problem with MTA-to-MTA, is that you'll never be in control of all the hops. I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks, and prevent the opportunistic upgrade: at that level, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.