17,780 reputation
1183256
bio website lamontconsulting.com
location New York, NY
age 38
visits member for 3 years, 11 months
seen 3 hours ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me


See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


Mar
7
revised What cookie attacks are possible between computers in related DNS domains (*.example.com)?
edited title
Mar
7
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
edited title
Mar
6
comment What are the risks of a Certificate Authority hack for 'the average user'?
See this RFC regarding storing certificates in DNS: DANE for TLS
Mar
6
revised What cookie attacks are possible between computers in related DNS domains (*.example.com)?
added 78 characters in body; edited title
Mar
6
comment What servers or clients are immune to related-domain cookie attacks? (*.example.com)
@D.W. I renamed it to "same domain cookie attacks"... how does that sound?
Mar
6
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
deleted 1 characters in body; edited title
Mar
6
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
edited title
Mar
6
asked What servers or clients are immune to related-domain cookie attacks? (*.example.com)
Mar
6
accepted What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Mar
6
revised What cookie attacks are possible between computers in related DNS domains (*.example.com)?
deleted 158 characters in body; edited title
Mar
6
comment What cookie attacks are possible between computers in related DNS domains (*.example.com)?
I'm thinking of keeping this Question open longer to see if there are any servers that detect or are immune to this. (Some HTTP Handler might detect two cookies with the same name) Is that a valid idea?
Mar
5
comment Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
Do you know what the HTTP Header is? Or Reg key?
Mar
5
revised Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
edited tags; edited title
Mar
5
revised For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
added 288 characters in body
Mar
5
comment For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Related: How to configure this in IIS/AD's config file to issue the correct MIME type
Mar
5
comment Issuing browser certificates to Chrome and Firefox with Microsoft CA
Will that work if the workstation is on the internet, not domain trusted, and some part of the CA (IIS?) is exposed via ssl?
Mar
5
revised For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
added 67 characters in body
Mar
5
revised For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
deleted 289 characters in body
Mar
5
revised Active Directory: Should Workstations be separated from servers to protect from related domain hacks?
edited tags
Mar
5
comment What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Thank you; I think this has implications for Active Directory... your advice on the linked question is appreciated