Reputation
2,957
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
8 19
Impact
~232k people reached

  • 0 posts edited
  • 0 helpful flags
  • 20 votes cast
Jan
30
awarded  Popular Question
Dec
8
awarded  Nice Answer
Aug
12
awarded  Yearling
Jun
10
awarded  Necromancer
May
29
awarded  Nice Answer
Sep
24
awarded  Autobiographer
Aug
12
awarded  Yearling
Aug
12
awarded  Yearling
Aug
12
awarded  Yearling
Jun
8
awarded  Caucus
Apr
20
awarded  Nice Answer
Sep
30
answered Should I ignore the BEAST SSL exploit and continue to prefer AES?
Sep
30
answered Can wildcard certificates hide/obscure the hostname in a TLS connection?
Sep
30
answered Does SSL/TLS (https) hide the urls being accessed
Sep
29
answered What should I know before configuring Perfect Forward Secrecy?
Sep
28
awarded  Tumbleweed
Sep
26
comment TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
It's worse than that - browsers need to offer TLS 1.1/1.2 and need to NOT accept downgrade to SSL3. Servers, likewise, need to turn on TLS 1.1/1.2 and disable support for SSL3. Simply getting both sides to enable TLS 1.1+ is not sufficient without simultaneously turning off SSL3.
Sep
26
comment What can I do about TLS 1.0 javascript injection vulnerability on my server?
And fwiw, the empty opening message has compat problems (still), but a one-byte opening message works, and is what Chrome is doing.
Sep
26
awarded  Critic
Sep
26
comment What can I do about TLS 1.0 javascript injection vulnerability on my server?
I think this advice no longer holds since the paper was released. Browsers can indeed fix this unilaterally (well, clients, more generally), but servers still have an independent need to ensure confidentiality, and at least for a while, they can't rely on the client to do the right thing.