Reputation
5,664
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
13 25
Newest
 Nice Answer
Impact
~151k people reached

9m
comment I almost searched my password, but didn't press enter. Because of autocomplete, is my password at risk?
Google Search has Google Instant, so your query is submitted even before you press enter.
1d
comment What's the point of the CA?
@AlexeyVesnin: good thing your client moved. With SNI being as widely supported as it is now, there's really no excuse for not supporting it, especially as there are many cheap, professionally managed shared hosting providers. Who knows what other obsolete, buggy, vulnerable software that such obsolete host is running.
1d
comment What's the point of the CA?
Also, with your regards to a virtual hosting that doesn't provide SNI, can you actually name one so the internet at large would know to avoid them. SNI support had already been in Apache and OpenSSL for more than a decade, even obsolete Long Term Support OSes would already have versions of OpenSSL that supports SNI.
1d
comment What's the point of the CA?
If you're not skilled enough to use the certificate UI in browsers, then you're not going to be skilled enough to use whatever UI Perspective Project system is going to have. Adding/removing root certificates/notaries is easily taught to even novice users, the difficult part is actually figuring out who is trustworthy and have the technical capabilities to perform proper identity checks. In the existing system, the browser provides this default, and for most people the browser's choices of trust worthy authorities/notaries are going to be much better than your own personal researches.
1d
comment What's the point of the CA?
The Perspective website is riddled with incorrect information. "You as a web browser user have little or no choice about who to trust" all major browsers have UI to add and revoke which root certificates you trust. "no visibility into whether these organizations deserve your trust." Public CA's are required to undertake audits and publish their statement of practice as part of their inclusion criteria in browser's default truststore. "certificate authority model also has problems with “virtual hosting”" this has not been an issue since SNI, SAN, Wildcard certificates which is widely supported.
1d
comment What's the point of the CA?
That's why SSH servers tells you the certificate fingerprint the first time you connect to a new server and asks whether it's correct. If you skip through that fingerprint matching, an attacker can MITM themself into your SSH connection.
2d
revised Can an administrator see all of my info on shared, private WiFi?
added 68 characters in body
2d
comment Can an administrator see all of my info on shared, private WiFi?
@Gui-Don: good point about opportunistic encryption. Personally, I don't consider opportunistic encryption as true encryption, but people might not realize that their email client may still drop to unencrypted when using STARTTLS.
2d
comment Can an administrator see all of my info on shared, private WiFi?
@Fiksdal: "administrative" here means that OP's neighbor has administrator control of one of the router that OP's Internet connection passes through. The premise of this question is that OP is piggybacking over his neighbor's internet connection, so OP doesn't have admin control in his neighbor's router.
Apr
25
awarded  Nice Answer
Apr
25
comment What is the difference, from a security perspective, between a USB Hard Drive and Flash Drive?
This is about external USB hard drive, not internal hard drive. And no, while they use the same protocol, they don't actually use the same internal physical storage type.
Apr
25
answered Hashing and signing partial data in payload
Apr
25
revised Can an administrator see all of my info on shared, private WiFi?
edited body
Apr
25
revised Can an administrator see all of my info on shared, private WiFi?
edited body
Apr
25
revised Can an administrator see all of my info on shared, private WiFi?
added 256 characters in body
Apr
25
answered Can an administrator see all of my info on shared, private WiFi?
Apr
22
comment Why is it so hard to close onion domains (e.g. The Silkroad)?
Essentially because .onion hosts is practically indistinguishable from intermediate nodes. If you control a large number of intermediate nodes, then maybe you can do traffic analysis, but this is even harder than exit node attacks.
Apr
22
answered How to automate sending messages about abused internet hosts
Apr
22
comment Let's Encrypt for intranet websites?
You don't necessarily need fancy DNS configuration to answer differently based on who is asking. If you configure your intranet VPN to favour internal DNS, that's configured to point to the real intranet, over the regular external DNS, that's normally run by your registrar configured to point to a publicly accessible server you trust to process domain verification, then you can pass the domain control verification, and then you can transfer the certificate over to your intranet.
Apr
19
comment Does HTTP Strict Transport Security (HSTS) make any sense in server to server communication?
One use of HSTS in servers that normally only serves other servers is if you sometimes access the API from a browser for debugging purpose (for example via postman or a custom written debug app), then you might forget to add https://. Other than that, I don't see any reason to use HSTS header in a server to server communication.