5,486 reputation
1824
bio website
location
age
visits member for 3 years, 4 months
seen 1 hour ago

1d
comment What are the disadvantages of implementing HTTP authentication in a web application?
@Xander I know, but the title of RFC 2617 is not just "HTTP authentication", but "HTTP Authentication: Basic and Digest Access Authentication". There could be (and there are) other forms of authentication when using HTTP. That's why I was asking for clarification.
1d
comment What are the disadvantages of implementing HTTP authentication in a web application?
Another disadvantage of HTTP Digest (using plain HTTP) compared to either Basic or Digest over HTTPS is that it doesn't protect the rest of the request: a MITM attacker could modify the payload of the request and change its meaning. This can indeed lead to a false sense of security.
1d
comment What are the disadvantages of implementing HTTP authentication in a web application?
You should clarify what you mean by "HTTP authentication" (and what other methods you have in mind).
1d
comment What are the disadvantages of implementing HTTP authentication in a web application?
"With digest access authentication its still necessary to send the password in clear text. However, only one time, at the registration." Actually, that's not true, the server can be set up with the "HA1" part without needing to know the actual password, ever.
Sep
10
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
@BenVoigt I agree 3D-secure only really protects the merchant (although your bank may make you agree with T&C claiming it protects the end-user). The major problem is that the authentication form is served within an iframe, which hides the URL and certificate validation of the 3D-secure page itself. That page often turns out to be some domain that has nothing to do with either the merchant, your bank or the card company. Of course, it's reasonably easy for an unscrupulous merchant site to make that iframe point to any proxy of its choice, which it could control: most users wouldn't notice it.
Sep
3
awarded  Good Answer
Aug
1
comment How do proxy servers protect their SSL certificates?
What you're talking about seems to be a reverse proxy server. They tend to be the web server, as far as the client is concerned, in which case threats to their certificates and private keys aren't really different from other web servers. The fact they're farming out requests to other servers tends to be an operational choice (e.g. for load balancing).
Jul
28
comment TLS WG Charter and Security Goals
@jww Actually you can teach developers to differentiate between good and bad guys. The middleware boxes are typically sanctioned by the institution where the application is going to be deployed. However uncomfortable this may be, the overall user is the good guy (their machines behind that middleware box and the box itself): whoever is in charge of that network should be able to configure the application to trust that box's CA cert. Developers should generally let users choose which CA certs they trust. To differentiate from the bad guys, developers must not bypass certificate verification.
Jul
23
revised Why different key exhange techniques for ssl key exchange?
added 398 characters in body
Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@DanNeely, it doesn't quite change the broader point of this discussion, but that's not how SSL works. Content is encrypted with symmetric keys negotiated during the handshake, not the certificate key.
Jul
13
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@ruief, as I was saying in a comment on by SF answer just now, the problem with MTA-to-MTA, is that you'll never be in control of all the hops. I'd guess attackers who are in a position to eavesdrop between MTAs are also very likely to be in a position to mount a MITM attacks, and prevent the opportunistic upgrade: at that level, the networks would tend to be within the hands of professionals exclusively, who'd certainly be in charge of the routers, etc.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@ruief, it would be good if you could substantiate your claims. I'm not saying you're necessarily wrong, but a few facts would do no harm here. Nothing's perfect. It sounds like you're in an environment where an element of paranoia may drive the agenda.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
Regarding MTA-to-MTA opportunistic encryption, I don't think SSL there (in an opportunistic deployment, i.e. falling back in plain text when SSL doesn't work) will be an obstacle for anyone in a position to perform large scale eavesdropping.
Jul
11
comment Why enable SMTP STARTTLS if OpenSSL is dangerous?
@rueif, "I don't tend to deploy troubled software based on how good I expect it might be in the future.". This sounds like speculation both ways anyway: we don't know what there is to improve (anything to substantiate the OpenSSL problems you've seen?) or what will be improved with this funding.
Jul
11
answered Why enable SMTP STARTTLS if OpenSSL is dangerous?
Jul
8
comment Can I use a single SSL cert on two different servers?
... or the cert has multiple Subject Alternative Names valid for both hosts. The downside of sharing a cert between multiple hosts is that you also share their private key, which means that the key is compromised on one host, this affects both. This can also cause problems in terms who assigning responsibilities if the two machines are administered by different people.
Jul
1
revised How to troubleshoot “client certificate” related errors in 2 way HTTPS
added 1196 characters in body
Jul
1
comment USB Token Authentication Security Issues
It depends on what you consider typical phishing. Basically, it would be the same as a username/password (except that you effectively have two passwords): if you're sure the server you're typing it into is what it says it is, if you trust it and if it's implemented properly, you should be OK. The problem is that there's no real additional security compared to a complex password (and having it on a USB stick is about the same as having it written down with you at all times...).
Jul
1
comment How to troubleshoot “client certificate” related errors in 2 way HTTPS
The developers tools in Chrome should let you see and save that.
Jun
30
revised How to troubleshoot “client certificate” related errors in 2 way HTTPS
Fixed typo