meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years |
| seen | Feb 15 at 19:53 | |
| stats | profile views | 21 |
|
1d |
awarded | Yearling |
|
Apr 15 |
awarded | Notable Question |
|
Feb 15 |
comment |
Is it safe to mix authentication methods?Can anyone who has temporary access to a users browser trivially export their saved browser certificates? But isn't this an issue with client certificate authentication in general? |
|
Feb 15 |
comment |
Is it safe to mix authentication methods? @MarkC.Wallace:Updated with example.I don't know about misuse.That is why I ask |
|
Feb 15 |
revised |
Is it safe to mix authentication methods? added 176 characters in body |
|
Feb 15 |
comment |
Is it safe to mix authentication methods? My example is the inverse of yours.The user provides password and the server gets the user's certificate for subsequent client certificate authentication.Does your analysis still apply? |
|
Feb 15 |
asked | Is it safe to mix authentication methods? |
|
Feb 8 |
accepted | What are the Netscape Cert Type attributes? Why/when are they needed? |
|
Nov 9 |
awarded | Popular Question |
|
Oct 31 |
comment |
Why isn't OCSP required by default in browsers? An example of OCSP relying on CRL is Microsoft PKI implementation. But I don't think the verification of the OCSP responder certificate is an issue. First of all because OCSP is not over SSL but plain HTTP. And if it is set to be over SSL and the responder certificate has been compromised the whole infrastructure goes down the drain, but this is also what happens if a CA certificate is compromised.And it is usually the CA that is the OCSP responder just using a different certificate |
|
Oct 31 |
comment |
Why isn't OCSP required by default in browsers? As far as (5) is concerned the action is not mandated by a standard.But it could be delegated to the user whether the connection should be dropped or not the same way as the responsibility is delegated to the user when a server sends a certificate not part of the trusted ones |
|
Oct 31 |
comment |
Why isn't OCSP required by default in browsers? I also don't agree with (2).Performance is not an issue when it comes to security.Browsers already are slower establishing an SSL connection in comparison to plain http connections.I don't think that a delay of 1-2 second more would be an issue |
|
Oct 31 |
comment |
Why isn't OCSP required by default in browsers? I don't agree with (3).CA gets a request for a certificate status from some IP.It can "sell" this IP with the certificate it requested for validation but that IP can not be bound with a specific client.IPs are dynamically assigned and this information would not be of much use |
|
Oct 24 |
accepted | Which attributes of a X509v3 certificate are never really used? |
|
Oct 24 |
comment |
Which attributes of a X509v3 certificate are never really used? So I understand that an organization can create its own "custom" extensions?Is this what you mean with the example of Microsoft?But in this case how are clients supposed to take these into account?Or are they for MS client implementations as well? |
|
Oct 24 |
asked | Which attributes of a X509v3 certificate are never really used? |
|
Oct 23 |
comment |
What are the Netscape Cert Type attributes? Why/when are they needed? Also when you say "there is little reason", do you have an example that we would need to use them? |
|
Oct 23 |
comment |
What are the Netscape Cert Type attributes? Why/when are they needed? I found this also:mozilla.org/projects/security/pki/nss/tech-notes/tn3.html which is rather dated but seems to take into account X509v3 Extensions.I have also seen occusionally certificates created with such extensions (can not give you a reference of an established CA that I have seen for this). |
|
Oct 23 |
asked | What are the Netscape Cert Type attributes? Why/when are they needed? |
|
Sep 25 |
awarded | Popular Question |
