meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years |
| seen | 17 mins ago | |
| stats | profile views | 266 |
|
May 13 |
awarded | Yearling |
|
Apr 25 |
comment |
Why clients offer handshaking with SSL 2.0 protocol Sun/Oracle/OpenJDK Java has had support for "SSLv2Hello" for a long time (without actual support for SSLv2), and it was used by default until Java 7. |
|
Apr 25 |
revised |
Why different key exhange techniques for ssl key exchange? deleted 6 characters in body |
|
Apr 25 |
comment |
Why different key exhange techniques for ssl key exchange? @armb yes, I meant DH parameters in the sense used in the specification (i.e. ServerDHParams). Indeed, not everything needs to change, just X and therefore dh_Ys. |
|
Apr 3 |
comment |
What certificates are needed for multi-level subdomains? What a CA says in its marketing material should be interpreted with caution. How names are verified doesn't depend on them, but on the client implementations and how they follow the specifications. When read closely, this sentence could mean that they'd issue a cert with a SAN for *.digicert.com and another SAN for server1.sub.mail.digicert.com, not necessarily that the cert will allow any subdomain at any level once issued. |
|
Mar 19 |
comment |
Certificate Chains When Importing Signed CSR Response Just a detail, shouldn't the chain be the other way around, from EEC to root, when it's sent? ("Each following certificate MUST directly certify the one preceding it.") |
|
Mar 19 |
answered | Could I delete .csr files when the key is signed by CA |
|
Mar 19 |
answered | Security of JVM for Server |
|
Mar 15 |
comment |
What is ASN.1 usage in SSL protocl and What's the risk of using it? @user20883, ASN.1 is used for encoding the certificate. It doesn't have much to do with the way the rest of the TLS connection works. The main issues with ASN.1 are about implementation bugs regarding the certificate verification (and host name verification). For the rest about SSL/TLS, you should read this question. In short, the usage of ASN.1 is part of the server authentication, which is essential for securing the connection. Using just encryption isn't enough. Btw, the pre master key is encrypted with RSA, not the session keys. |
|
Mar 15 |
comment |
Key authentication with ssl @SmitJohnth, you can indeed use self-signed client certs (although I'd still verify the server cert the traditional PKI way), but this may require a bit of tweaking, since most frameworks expect a PKI model. In most cases, you may have to implement your own trust evaluation with the SSL/TLS stack, or disable it and do it within your application. Make sure your customisations eventually perform some form of verification (e.g. against a fixed list of public keys) before considering the client to be authenticated, from the application's point of view. |
|
Mar 13 |
awarded | certificates |
|
Dec 20 |
awarded | Nice Answer |
|
Dec 11 |
comment |
How do I prevent this type of SQL injection attack? @Jeff, the issue isn't really related to the encoding, rather it has to do with the fact the (decoded) parameter contains a quote, and isn't escaped. |
|
Dec 11 |
revised |
openssl, create RC4-SHA certificate added 135 characters in body |
|
Dec 11 |
answered | openssl, create RC4-SHA certificate |
|
Nov 28 |
comment |
Safe to make a VPN connection over coffee shop WIFI? It seems to some default configuration of some PPTP implementations have encryption as optional by default. As usual, good configuration is key. |
|
Nov 28 |
comment |
Safe to make a VPN connection over coffee shop WIFI? @AJHenderson, I think part of the problem in this article comes from the confusion between HTTPS and SSL. Not all SSL-based VPNs use HTTPS (i.e. are meant to be used from the browser), for example OpenVPN. If this particular VPN technology relies on pointing a browser to an HTTPS page, the usual protection mechanisms apply: more specifically, the user need to check they're indeed using HTTPS (or HTST can be used, when possible). |
|
Nov 28 |
answered | Safe to make a VPN connection over coffee shop WIFI? |
|
Nov 28 |
comment |
How secure is aSSL (javascript)? Does it effectively mimic SSL? Well, it could be OK to protect against eavesdropping perhaps, but it will be useless as far as protecting against MITM is concerned, however much work you put into it. |
|
Nov 27 |
answered | Client Certificate in SSL HandShake insecure? |
