Reputation
21,289
Next tag badge:
80/100 score
26/20 answers
Badges
20 123 317
Impact
~1.4m people reached

Aug
31
comment Are the rules used to validate certificates in the major browsers documented anywhere?
Not to mention if CRLs are used, AIAs if the whole chain is sent, HTS, DANE, OCSP. THEN we get to talk about cipher suites, validation for special features (Same Origin), Channel Based Cookies, version downgrade support, KeyUsages, EKU, support for the Critical keys, validation of intermediate keys (some don't check revoked intermediates). This is a big, but awesome question.
Aug
30
comment How important is split-horizon DNS?
If you're using Windows DNS, it should be pretty easy to use Powershell to iterate through all the records and update them with the contents of the external DNS server (Get-DnsServerResourceRecord)
Aug
30
comment How important is split-horizon DNS?
Sometimes, there is a technical infrastructure need for this (AD), and the rationale, and extra complexity /hassle is a side effect. Sometimes the initiative for this design isn't security related.
Aug
30
comment Possible for Lync (Skype for Business) to adopt Activesync-style policies?
@schroeder I'm OK with the move - what happens to the bounty (doesn't matter really to me)
Aug
29
comment What are the performance and security tradeoffs when selecting “ECC” or “Subgroup” in a U-Prove token?
@CodesInChaos Bouncy Castle changed and improved their ECC implementation. Does the issue you describe still exist? (timing attack, slowness, etc)
Aug
29
comment How can I demonstrate that 3 independent root CAs validated my domain?
@DavidHoude Added additional context
Aug
29
comment How can I demonstrate that 3 independent root CAs validated my domain?
@NicBarker It would be hard to do, but I'll take any approach.
Aug
28
comment Proving an encrypted message contains (but does not 100% consist of) a plain-text message?
Homomorphic encryption, and specifically the Pedersen commitment may help you here. For more advanced crypto questions, please see: crypto.stackexchange.com
Aug
26
comment When do honest people need privacy or anonymity? (e.g. they have nothing to hide)
@paj28 LOVE it!
Aug
22
comment Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)
@NobuGames This could be a valuable answer, and not subject to deletion or non indexing as a comment. Why is OpenJDK better? How does it compare? Would there be support issues if I used it with Android? (or Xamarin for that matter?)
Aug
19
comment How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?
I'm on Safari and can't translate that page, so yes a summary would be nice. Also this describes more about the original android vulnerability blog.lookout.com/blog/2010/12/09/android-touch-event-hijacking
Aug
19
comment How to prove ownership of a website?
SSLStrip and other hacks can trick even the sophisticated user. When using a mobile device, no SSL icon is visible, further worsening the security position.
Aug
19
comment How to prove ownership of a website?
You're referring to a variant of SiteKey, which is "Security Theatre" - security.stackexchange.com/a/26380/396
Aug
16
comment P12 - Extract public part (certificate) without knowing the p12 password
if any part of it is readable, this site might help (not sure if P12 is ASCII or binary : lapo.it/asn1js
Aug
14
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
... otherwise the client might be carrying around "system state" from ASPX days. msdn.microsoft.com/en-US/library/ms178581.aspx ... by the client choosing the data to post, they are in fact defining their existence to the server in its entirety
Aug
14
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
Perhaps I should be more clear in my intent. I have a custom privacy preserving TCP client that mostly does HTTP/1.1 actions. Since this is residing in an EXE I want to redefine the authentication mechanism to be more private that what is currently available. Privacy is my key selling point. The problem I have with the POST and the cookie is that the SERVER assigns the value. When this assignment happens, it might correlate to other backend data. By the client choosing the bearer token value, then the client knows what it's carrying around in a blob..
Aug
11
comment Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?
Thank you. I asked this because I was rethinking this answer, and wondering if the load balancer to web server unencrypted vs a vulnerable SSL is more or less risky.
Aug
10
comment PKI usage in a cluster; per application instance or per application?
Regarding private keys not traveling, what about email signatures? Or decryption of inbound emails? Keys need to be on multiple devices (phone, work, kiosk, etc).
Aug
7
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
On second thought Perhaps a random cookie name isn't required... but I do appreciate the feedback
Aug
7
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
Regarding the cookie being read by Javascript, and a XSS I was assuming that a plugin or other hypothetical change to a browser would prevent this from occurring.