6,384 reputation
11234
bio website
location
age
visits member for 4 years, 1 month
seen 3 hours ago

May
13
awarded  Yearling
May
1
comment Why is a public key called a key - isn't it a lock?
There some subtlety in the English language here. Some of the other uses of the word key could be translated with different words in other languages, because they represent rather different concepts. The vast majority of documents talking about encryption represent key in the "key+lock" sense, often with accompanying pictures. I've never seen a document about encryption illustrated with a piano, musical or map type of key.
May
1
comment Why is a public key called a key - isn't it a lock?
@cpast I totally agree. In fact, "encrypting with the private key" and "deciphering with the public key" go against the very definition of the word "encryption", in plain English. If anyone with the public key can "decrypt" the content, then it was never really "encrypted" in the first place, by definition.
May
1
answered Is TLS 1.0 more secure than TLS 1.2?
Mar
22
awarded  Nice Answer
Mar
20
awarded  Announcer
Mar
14
comment Why do mobile apps have fine-grained permissions while desktop apps don't?
@AndréDaniel You're right, but the usage pattern is somehow different. It might just be an impression, but users would tend to be more cautious when installing something on a PC (and sometimes might be prevented from doing so), as opposed to a mobile app, where the distribution model makes it barely harder than visiting a website. It also seems generally more difficult to check what the app is actually doing (where it's installed and so on) on a mobile phone than on a PC (e.g. the user doesn't generally have root/admin access on the mobile device, at least for most consumers).
Mar
11
awarded  Nice Answer
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
Sure, but anyone in a position to intercept the hash would then be able to authenticate to that server anyway. It seems to make the client side more complicated, for a relatively limited improvement.
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
It seems that using the mechanism you suggest, the hash itself effectively becomes the password (not from a UI point of view, but from a client-server point of view). Hence, the advantages are limited as far as the client-server interaction is concerned.
Feb
19
comment Are secret URLs secure over HTTPS?
Yes, I've tried. There's a draft spec to try to have a bit more control, but the default is still "No Referrer When Downgrade". (It's relatively easy to check if you have an https:// link to another site from an https:// page somewhere with your browser's dev tools open.)
Feb
19
comment How to detect if I am vulnerable to “Superfish,” and how to remove it?
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.". Hum... besides the fact they were apparently shipping the same trusted CA certificate and its private key (embedded somewhere in that software) to all affected units. Terrible statement.
Feb
18
comment Are secret URLs secure over HTTPS?
@ThomasPornin However, browsers still send the URL in the Referer when going from an HTTPS page to another HTTPS page in general, even if that other HTTPS page is on a completely different host.
Feb
18
answered What part of TLS specifies how to verify a certificate chain
Feb
18
answered Why do browsers default to http: and not https: for typed in URLs?
Jan
29
awarded  Announcer
Jan
8
comment Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?
"The length of the URL path is visible to all eavesdroppers". How? Sure, rough guesses can be made from the size of the encrypted packets, but the exact length, really, especially when you consider headers that may also vary in length?
Dec
23
awarded  Announcer
Dec
17
awarded  tls
Nov
27
comment Advantages of client certificates for client authentication?
@RemiDespres-Smyth By definition SSL/TLS client-certificate authentication can only be used with SSL/TLS. Sniffing the public key/certificate isn't necessarily a problem since it won't make the cert usable (at worse, an eavesdropper seeing the cert will know the identity of the user). The cert is actually visible in clear if it is exchanged during the initial SSL/TLS handshake, but it can be hidden when using a renegotiated handshake.