Reputation
7,252
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 17 35
Newest
 Guru
Impact
~1.0m people reached

Jan
9
awarded  Guru
Jan
7
awarded  Good Answer
Dec
24
comment How do I check that I have a direct SSL connection to a website?
@EloyRoldánParedes Sure, but that's why I said it's "roughly" equivalent to IP routing proxy. Having or not having the host name is a little different indeed, but in terms of protection this is very similar since someone in a routing proxy position can often work out the hostname (with some element of traffic inspection indeed not needed with HTTP CONNECT), either via SNI (or by DNS lookup or querying the cert themselves, when SNI is not used). I'd still put them in the same broad category, compared with the other two proxy types.
Dec
23
comment How do I check that I have a direct SSL connection to a website?
@EloyRoldánParedes No, with HTTP CONNECT, you only give the host and port you're going to connect to, not the URL (See RFC 2817 Section 5.2: "The Request-URI portion of the Request-Line is always an 'authority' as defined by URI Generic Syntax [2], which is to say the host name and port number destination of the requested connection separated by a colon".
Dec
14
awarded  Good Answer
Nov
3
awarded  Good Answer
Sep
12
awarded  Necromancer
Aug
20
awarded  Autobiographer
May
13
awarded  Yearling
May
1
comment Why is a public key called a key - isn't it a lock?
There some subtlety in the English language here. Some of the other uses of the word key could be translated with different words in other languages, because they represent rather different concepts. The vast majority of documents talking about encryption represent key in the "key+lock" sense, often with accompanying pictures. I've never seen a document about encryption illustrated with a piano, musical or map type of key.
May
1
comment Why is a public key called a key - isn't it a lock?
@cpast I totally agree. In fact, "encrypting with the private key" and "deciphering with the public key" go against the very definition of the word "encryption", in plain English. If anyone with the public key can "decrypt" the content, then it was never really "encrypted" in the first place, by definition.
May
1
answered Is TLS 1.0 more secure than TLS 1.2?
Mar
22
awarded  Nice Answer
Mar
20
awarded  Announcer
Mar
11
awarded  Nice Answer
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
Sure, but anyone in a position to intercept the hash would then be able to authenticate to that server anyway. It seems to make the client side more complicated, for a relatively limited improvement.
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
It seems that using the mechanism you suggest, the hash itself effectively becomes the password (not from a UI point of view, but from a client-server point of view). Hence, the advantages are limited as far as the client-server interaction is concerned.
Feb
19
comment Are secret URLs secure over HTTPS?
Yes, I've tried. There's a draft spec to try to have a bit more control, but the default is still "No Referrer When Downgrade". (It's relatively easy to check if you have an https:// link to another site from an https:// page somewhere with your browser's dev tools open.)
Feb
19
comment How to detect if I am vulnerable to “Superfish,” and how to remove it?
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.". Hum... besides the fact they were apparently shipping the same trusted CA certificate and its private key (embedded somewhere in that software) to all affected units. Terrible statement.
Feb
18
comment Are secret URLs secure over HTTPS?
@ThomasPornin However, browsers still send the URL in the Referer when going from an HTTPS page to another HTTPS page in general, even if that other HTTPS page is on a completely different host.