5,346 reputation
1724
bio website
location
age
visits member for 3 years, 2 months
seen 19 hours ago

2d
comment TLS WG Charter and Security Goals
@jww Actually you can teach developers to differentiate between good and bad guys. The middleware boxes are typically sanctioned by the institution where the application is going to be deployed. However uncomfortable this may be, the overall user is the good guy (their machines behind that middleware box and the box itself): whoever is in charge of that network should be able to configure the application to trust that box's CA cert. Developers should generally let users choose which CA certs they trust. To differentiate from the bad guys, developers must not bypass certificate verification.
Jul
23
revised Why different key exhange techniques for ssl key exchange?
added 398 characters in body
Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@DanNeely, it doesn't quite change the broader point of this discussion, but that's not how SSL works. Content is encrypted with symmetric keys negotiated during the handshake, not the certificate key.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@ruief, as I was saying in a comment on by SF answer just now, the problem with MTA-to-MTA, is that you'll never be in control of all the hops. I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks, and prevent the opportunistic upgrade: at that level, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@ruief, it would be good if you could substantiate your claims. I'm not saying you're necessarily wrong, but a few facts would do no harm here. Nothing's perfect. It sounds like you're in an environment where an element of paranoia may drive the agenda.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
Regarding MTA-to-MTA opportunistic encryption, I don't think SSL there (in an opportunistic deployment, i.e. falling back in plain text when SSL doesn't work) will be an obstacle for anyone in a position to perform large scale eavesdropping.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@rueif, "I don't tend to deploy troubled software based on how good I expect it might be in the future.". This sounds like speculation both ways anyway: we don't know what there is to improve (anything to substantiate the OpenSSL problems you've seen?) or what will be improved with this funding.
Jul
11
answered Why enable SMTP STARTTLS if OpenSSL is dangerous?
Jul
8
comment Can I use a single SSL cert on two different servers?
... or the cert has multiple Subject Alternative Names valid for both hosts. The downside of sharing a cert between multiple hosts is that you also share their private key, which means that the key is compromised on one host, this affects both. This can also cause problems in terms who assigning responsibilities if the two machines are administered by different people.
Jul
1
revised How to troubleshoot “client certificate” related errors in 2 way HTTPS
added 1196 characters in body
Jul
1
comment USB Token Authentication Security Issues
It depends on what you consider typical phishing. Basically, it would be the same as a username/password (except that you effectively have two passwords): if you're sure the server you're typing it into is what it says it is, if you trust it and if it's implemented properly, you should be OK. The problem is that there's no real additional security compared to a complex password (and having it on a USB stick is about the same as having it written down with you at all times...).
Jul
1
comment How to troubleshoot “client certificate” related errors in 2 way HTTPS
The developers tools in Chrome should let you see and save that.
Jun
30
revised How to troubleshoot “client certificate” related errors in 2 way HTTPS
Fixed typo
Jun
30
comment How to troubleshoot “client certificate” related errors in 2 way HTTPS
You need the Host header with HTTP/1.1 (try HTTP/1.0 just in case perhaps).
Jun
30
comment How to become Intermediate Certificate Authority?
Becoming your own CA as detailed in the link you refer to is fairly easy. Anyone can do that if they're willing to have to add their CA cert into each potential client. The problem in this question is about becoming a intermediate CA for a CA that is already bundled by default with common OS/browsers.
Jun
30
answered How to troubleshoot “client certificate” related errors in 2 way HTTPS
Jun
30
comment How to troubleshoot “client certificate” related errors in 2 way HTTPS
Do you have access to the server?
Jun
30
answered x509 serial number - hex or decimal
Jun
30
answered USB Token Authentication Security Issues
Jun
30
comment USB Token Authentication Security Issues
"what other security issues this mechanism has?": what security enhancement do you expect that token to provide?