13,255 reputation
34498
bio website neal.mcburnett.org
location Boulder, CO
age
visits member for 4 years, 8 months
seen Jul 29 at 1:15

I like to engage in "Technology Serving Community" via free software.

Consultant, Data scientist, Ubuntu member, Wikipedia contributor since 2002, ElectionAudits developer, Boulder Community Network co-founder, Internet2 consultant for IDtrust, author of pgpstat, Android enthusiast, ex-Bell Labs web/security/standards maven....

See my web site for way more: http://neal.mcburnett.org/


Jul
23
awarded  Caucus
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Can you consolidate your answer to lead with the variety of ratings, which really helps inform our speculation about why they make these choices? Also, since there are 4 distinct attacks, I suppose they might come up with a rating for each.... Then I'll accept it. Thanks for the very helpful research!
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Interesting also that SCIP ranks it as "high" access complexity. That may apply to the Integrity and Availability scores they give, and I suppose that for a time it might apply to the Confidentiality score. But it seems to me that the best scoring is by Polycom, IBM and Redhat: (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
Jul
2
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
@StackzOfZtuff Wow - fascinating. And IBM rates it as I:N also (no integrity impact), which may reflect an assessment that it is much harder to get MITM there, IIRC.
Jun
30
asked Why is logjam rated as “None” for confidentiality impact in CVSS?
Jun
30
comment How to Check if a server is not vulnerable to logjam?
Thanks for trying to be helpful :) Perhaps you could update your answer to clarify what those sites are saying.
Jun
2
awarded  Favorite Question
May
30
awarded  Necromancer
May
29
answered Do security questions subvert passwords?
May
25
comment Does DNSSec have any benefit if used with IPSec-enabled IPv6?
@Pacerier Yes - thanks for the prompt. I updated the answer
May
25
revised Does DNSSec have any benefit if used with IPSec-enabled IPv6?
kidns => dane and others
May
24
comment Does hashing a file from an unsigned website give a false sense of security?
@Pacerier Yes, an attacker can modify the binary, and they can modify a simple checksum. That is the whole point of this question - simple checksums provide little additional security. But public key signatures provide lots of additional security, since if someone changes the signature, it won't be valid when checked. And they would have to have access to the signers private key (which is hopefully offline and may be secured in a hardware security module) to create a valid signature for a modified binary.
May
24
awarded  Tumbleweed
May
23
comment Does hashing a file from an unsigned website give a false sense of security?
@Pacerier HTTPS only protects data in transit between your client and the site. It doesn't tell you anything about the files that are served by the site. Since an attacker can often get files on to a site, via a wide variety of methods (up-front, surreptitious or illegal), you really need file-level signatures.
May
17
asked Software Defined Perimeter assumptions, properties, deployment scenarios
Apr
11
asked Examples of “Runtime application self-protection” (RASP) in action?
Mar
29
comment symmetric encryption session keys in SSL/TLS
@Pacerier Good point. I'm not suggesting that the current SSL/TLS design would work if quantum computing broke public key cryptography. I edited the answer.
Mar
29
revised symmetric encryption session keys in SSL/TLS
clarify not a real alternative
Mar
22
awarded  Good Question
Mar
9
awarded  Famous Question