19,035 reputation
1591266
bio website lamontconsulting.com
location New York, NY
age 38
visits member for 4 years, 1 month
seen 7 hours ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me


See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


Mar
7
revised Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
added 207 characters in body
Mar
7
comment Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
@Ramhound - I can't research what I don't know. To that point I asked this question. My knowledge of Chrome Frame is imperfect, but my question is still valid. If I knew to search for xxx protocol handler name, then I would. No one so far has mentioned it. I'm still gathering information about broweser integration that exists, but isn't quite in the public eye.
Mar
7
comment Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
What is the difference between this and DANE tools.ietf.org/html/draft-ietf-dane-protocol-17
Mar
7
comment Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
@ordag - I want to list the knowns and unknowns threats between each (TOR vs HTTPS) and see where they overlap and where they are different. So far, the utilization of DNS seems to be a key differentiator.
Mar
7
comment Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
So it seems TOR is better/more secure since it doesn't use DNS, and it doesn't rely on CAs. Add to that complete anonymity and it's quite safe for certain applications
Mar
7
comment Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
Leaving the TLS protocol discussion aside for now... Since HTTPS broken by one "bad" CA, or DNS Hijack would you agree that TOR is more secure since it doesn't use DNS or CAs?
Mar
7
revised Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
added 159 characters in body
Mar
7
answered Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
Mar
7
comment Convergence - an SSL replacement?
Related - DNS-Based Authentication of Named Entities (DANE)
Mar
7
comment Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?
@Ramhound - I now see that Chrome Frame is a second install... I thought it came with Chrome.
Mar
7
comment What servers or clients are immune to related-domain cookie attacks? (*.example.com)
@D.W. Ahh, related domain cookie attacks makes a lot more sense then what I wrote there before!
Mar
7
revised What cookie attacks are possible between computers in related DNS domains (*.example.com)?
edited title
Mar
7
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
edited title
Mar
6
comment What are the risks of a Certificate Authority hack for 'the average user'?
See this RFC regarding storing certificates in DNS: DANE for TLS
Mar
6
revised What cookie attacks are possible between computers in related DNS domains (*.example.com)?
added 78 characters in body; edited title
Mar
6
comment What servers or clients are immune to related-domain cookie attacks? (*.example.com)
@D.W. I renamed it to "same domain cookie attacks"... how does that sound?
Mar
6
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
deleted 1 characters in body; edited title
Mar
6
revised What servers or clients are immune to related-domain cookie attacks? (*.example.com)
edited title
Mar
6
asked What servers or clients are immune to related-domain cookie attacks? (*.example.com)
Mar
6
accepted What cookie attacks are possible between computers in related DNS domains (*.example.com)?