415 reputation
28
bio website althack.org
location Cambridge, MA
age 23
visits member for 1 year, 6 months
seen Oct 22 at 17:04

Oct
20
awarded  Nice Answer
Jul
4
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
@Alexandru How would the CA give the NSA a private key they don't even have access to themselves? See my earlier comment.
Jun
23
awarded  Yearling
Oct
20
comment How is a Tor hidden service immune to exit node attacks?
Yes -- but if there is an adversary with unlimited computing power, they have a lot of potential ways to break the secrecy, they certainly don't need access to that node. Regarding your side question, you should really ask that in a separate question, but the answer is that any Tor circuit generates session keys for each layer of the onion in order to establish some sort of forward secrecy.
Oct
20
answered How is a Tor hidden service immune to exit node attacks?
Jul
26
awarded  Enthusiast
Jul
18
awarded  Commentator
Jul
18
comment Modern, security-conscious, PHP book?
If you're looking for a modern, security-conscious book about PHP, I'd like to recommend "How to stop using PHP".
Jul
8
revised Serving data from an encrypted database over an encrypted connection
added 26 characters in body
Jul
8
answered Serving data from an encrypted database over an encrypted connection
Jul
7
comment Small encrypted network setup
Making a system "secure" is impossible without understanding what the system's goals are, and what adversaries it needs to protect against. It seems that you're asking for general advice but also at the same time specific advice regarding your system -- if you want specific advice then you need to provide what I mentioned earlier (long before discussing any specific tools you are using to secure your system currently).
Jul
2
comment Tor and regular browser side by side. Does that make sense?
The only thing that anyone should learn from that XKCD comic is that you should improve your physical security as well in the face of a serious adversary.
Jun
30
awarded  Critic
Jun
30
awarded  Editor
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Most browsers do not actually give warnings for certificate changes.
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
@AJHenderson Good point, thanks; I clarified the opening sentence.
Jun
30
revised Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Clarification.
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
CAs do not give out private/public key pairs. They sign them. The CA never sees the private key of the certificate, all they see is the Certificate Signing Request. So the NSA would not be able to get the private key from the CA.
Jun
30
answered Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Jun
29
awarded  Informed