Reputation
299
Top tag
Next privilege 300 Rep.
Create new tags
Badges
3 13
Impact
~9k people reached

Mar
29
comment Restricting Issuing CA's choice of keyUsage and extendedKeyusage
Not via PKI means. Once you have granted a sub-CA its licence to mint certificates, technically it can do whatever it wants. You then need additional technical controls in place, like secure logs (remote and/or hash-chained + signed), protect the sub-CA's keys and so on. Sticky business
Mar
28
answered Restricting Issuing CA's choice of keyUsage and extendedKeyusage
Feb
19
awarded  Notable Question
Jan
22
awarded  Scholar
Jan
22
accepted Preventing LSASS from storing clear-text passwords in Kerberos environment
Jan
22
comment Preventing LSASS from storing clear-text passwords in Kerberos environment
A type 2 login, network login doesn't deposit clear text login correct
Dec
17
awarded  Popular Question
Aug
27
awarded  Tumbleweed
Aug
25
comment Is there any problem using empty salts with PBDKF for this purpose?
How many keys do you need - one or many? If just the one, then any salt ought to do, if many - wouldn't the salt mitigate the use of symmetric key re-use?
Aug
25
awarded  Critic
Aug
25
awarded  Commentator
Aug
25
comment Is Postgres password-based authentication secure?
@Tom_Leek - could you revise your answer in light of the answer below and the use of random salt? To me it seems like it has the strength of challenge-response and is not susceptible to replay?
Aug
20
asked Struts standard administrative actions unprotected - so what?
Aug
20
awarded  Notable Question
Jan
12
answered Malware known for stealing private ssh keys
Jan
12
comment Advanced techniques for detecting a proxy/getting original IP
To add to the above answer, the OP may simply may have made mistakes when configuring proxy, the site may decide that logging in from 2 different IPs within an hour is a security risk or finally not work unless JavaScript is enabled. In short, the odds are that the site isn't detecting a proxy (althogh MaxMind does have a neat proxy blacklist which some sites can use), but rather weirdness and scraping.
Dec
14
answered Yubikeys & SSH - which option is best for lockdown?
Dec
4
awarded  Popular Question
Sep
24
awarded  Autobiographer
Jun
9
revised Are legal notices in a login banner legally significant in terms of computer misuse?
Fixed spelling, added links