495 reputation
514
bio website
location
age
visits member for 3 years, 2 months
seen Aug 10 '13 at 8:19

Jul
2
awarded  Curious
Jun
2
awarded  Notable Question
Nov
15
awarded  Popular Question
Oct
25
awarded  Notable Question
Aug
26
awarded  Popular Question
Jul
25
awarded  Nice Question
May
23
awarded  Yearling
Apr
15
awarded  Notable Question
Feb
15
comment Is it safe to mix authentication methods?
Can anyone who has temporary access to a users browser trivially export their saved browser certificates? But isn't this an issue with client certificate authentication in general?
Feb
15
comment Is it safe to mix authentication methods?
@MarkC.Wallace:Updated with example.I don't know about misuse.That is why I ask
Feb
15
revised Is it safe to mix authentication methods?
added 176 characters in body
Feb
15
comment Is it safe to mix authentication methods?
My example is the inverse of yours.The user provides password and the server gets the user's certificate for subsequent client certificate authentication.Does your analysis still apply?
Feb
15
asked Is it safe to mix authentication methods?
Feb
8
accepted What are the Netscape Cert Type attributes? Why/when are they needed?
Nov
9
awarded  Popular Question
Oct
31
comment Why isn't OCSP required by default in browsers?
An example of OCSP relying on CRL is Microsoft PKI implementation. But I don't think the verification of the OCSP responder certificate is an issue. First of all because OCSP is not over SSL but plain HTTP. And if it is set to be over SSL and the responder certificate has been compromised the whole infrastructure goes down the drain, but this is also what happens if a CA certificate is compromised.And it is usually the CA that is the OCSP responder just using a different certificate
Oct
31
comment Why isn't OCSP required by default in browsers?
As far as (5) is concerned the action is not mandated by a standard.But it could be delegated to the user whether the connection should be dropped or not the same way as the responsibility is delegated to the user when a server sends a certificate not part of the trusted ones
Oct
31
comment Why isn't OCSP required by default in browsers?
I also don't agree with (2).Performance is not an issue when it comes to security.Browsers already are slower establishing an SSL connection in comparison to plain http connections.I don't think that a delay of 1-2 second more would be an issue
Oct
31
comment Why isn't OCSP required by default in browsers?
I don't agree with (3).CA gets a request for a certificate status from some IP.It can "sell" this IP with the certificate it requested for validation but that IP can not be bound with a specific client.IPs are dynamically assigned and this information would not be of much use
Oct
24
accepted Which attributes of a X509v3 certificate are never really used?