Reputation
2,691
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
10 19
Newest
 Excavator
Impact
~79k people reached

2d
comment Cloudflare's free SSL options require trusting them; what could they do to change that?
HTTPS can be easily extended to support encryption as a Content-Encoding. The CDN could then cache the encrypted data, without necessarily knowing the content of the encrypted data themselves. This would require the client application to know how to decode the Content Encoding.
2d
comment Cloudflare's free SSL options require trusting them; what could they do to change that?
The selling point of Cloudflare is that they do application layer traffic analysis. This necessarily requires them to decrypt the traffic. If you don't want them to decrypt traffic, then you have to do your traffic analysis in house and Cloudflare would be limited to TCP/IP filtering. This is insensible, because if you do traffic analysis in house, the attacker already won if it can overwhelm your traffic analyzer (this is essentially an IDS/Intrusion Detection System). Also, there are many better options to do TCP/IP filtering than Cloudflare.
2d
comment Cloudflare's free SSL options require trusting them; what could they do to change that?
A middlemen does not necessarily require the private key. This can be done by splitting the TLS handshake between the origin server and the middlemen, the middlemen ends up with the session key without needing the private key; this is similar to how an HSM can let the server decrypt TLS without disclosing the private key. Cloudflare calls this technology Keyless SSL, which lets you use Cloudflare without giving them your private key.
Aug
21
comment Does the carrier network autheticates itself to the SIM card?
@user3362334: according to this article: The Stingray ‘jams’ local 3G and 4G networks, forcing all phones in the area to ‘drop down’ to 2G.
Aug
21
revised Does the carrier network autheticates itself to the SIM card?
added 14 characters in body
Aug
21
answered Does the carrier network autheticates itself to the SIM card?
Aug
17
awarded  Excavator
Aug
17
revised Is there any technical security reason not to buy the cheapest SSL certificate you can find?
deleted 7 characters in body
Aug
15
reviewed Approve Rails - protection against code injection and XSS
Aug
15
reviewed Approve Are bookmarklets safe with facebook data?
Aug
13
comment Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
Still, you should audit your .authorized_keys file. While having authorized_keys stolen isn't a security issue, having an entry there that you don't recognize is a security issue.
Aug
13
comment Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?
authorized_keys stores public keys. It's not intended to be a secret in SSH security model. Your id_rsa should be encrypted, and if you have a strong password, having the encrypted file stolen shouldn't be a cause for immediate alarm (replace the key in time, but do not need to panic).
Aug
12
comment Why Skype discloses my IP address to anybody?
Only Microsoft can answer this. VoIP/video chat uses peer to peer connection (the caller/callee connects to each other directly instead of through a server) which requires a participant in a call to have each other's IP address. But there are no reasons why people not in your contacts list need to know your IP address if you only allow calls from people in your contact list.
Aug
7
comment Not storing the salt? Is that an option?
When evaluating the security of a system, assume Kerckchoff principle "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." Assume that your attacker knows your salt generation scheme; your base system should remain secure even with knowledgeable attacker. Anything you do above that base is security theater.
Aug
7
comment Not storing the salt? Is that an option?
Actually, salt doesn't just have to be unique, the purpose of the salt is to add entropy to the hashing algorithm, thus salt needs to have sufficient entropy. Salt with low entropy is still better than no salt, but it's not a good salt.
Aug
7
comment Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?
@sebix: I don't mean the CA is doing ongoing check, but rather as long as the domain registration is valid, a CA may send their verification email to that registered email. This means that if your email is intercepted, the attacker can issue themselves a valid TLS certificate. It's not sufficient to ensure the secure delivery of email during your initial TLS verification, but rather you need to ensure continuous security of the email during the entire length of the domain registration.
Aug
6
comment Is BASIC-Auth secure if done over HTTPS?
@Artjom: Sending Basic credentials on every request is an issue, not because you have to keep sending the credentials, but rather because the same string is sent on every request. There are other authentication mechanisms, like HMAC, where the Authorization header cannot be decrypted back to the user's secret, and the server can authenticate the request without actually knowing the user's secret. In this mechanism, the string sent on the Authorization header changes based on the hash of the request.
Aug
3
comment Is HTML5 vibrate feature a security vulnerability?
@phyrfox: good grammars doesn't necessarily mean it's a legitimate warning. While bad grammar is an immediate give away that the warning is likely illegitimate, there see other things you need to pay attention to; for example, the "The page at ... says" is a dead give away that the dialog box is from the page in the browser, not the system.
Aug
3
revised How safe are data you dial to a call center?
added 331 characters in body
Aug
3
answered How safe are data you dial to a call center?