166 reputation
5
bio website syneticon.net
location Germany
age
visits member for 3 years, 3 months
seen Dec 6 at 17:27

I am working for a company which is doing infrastructure operations and IT consulting jobs in Germany, Europe.

My sphere of activities includes virtualization topics, IP networking, storage, server operations, monitoring, backups and network security. I was awarded the Microsoft MVP title for Windows Networking for several years in the past, although my public activity on Microsoft-specific topics has declined seriously due to lack of time so it is not likely to happen again that soon.

If you need to get in touch, just mail the company: office@syneticon.net

If you are wondering about the avatar bunny, Ubisoft supplies a lot more to look at and wonder about.


Dec
2
awarded  Commentator
Dec
2
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd there is a trust chain in X.509 certificates, but it is a chain of certification authorities only. Either way, the big CA players are not going to give up their gold mine easily, so we probably will see another couple of years go by before the PKI for the general public will start changing.
Dec
2
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd the point I am making that the certification authority for a name space belongs with the registration authority for this very name space - in the case of DNS names this would be the DNS zone admin. The exact mechanism of publication for the resulting certificates does not matter that much. But it seems I was mistaken about putting application keys into DNS. It has been a couple of years I have last tried to air this topic with IETF working group members. In the meantime, the DANE working group proposing this very thing has formed.
Dec
1
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd I understand the main line of reasoning is that DNS zones should not contain data unrelated to DNS, so basically it is about conceptional cleanliness. The problem you are describing might be fixed by a well-designed and well-implemented name constraint mechanism. X.509 has name constraints specified as of RFC 5280, but these are defunct in most implementations, making them essentially useless.
Dec
1
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd which is not going to happen all that soon - there is strong opposition within the IETF to putting application keys into DNS. There is RFC 4387, but it is not seeing notable implementations in clients as of today
Sep
24
awarded  Autobiographer
Jun
25
comment Are login “certificates” more secure than standard username + password authentication?
A private key is significantly harder to attack and steal once it is stored on a smart card and not accessible directly. Smart cards can be used as certificate / key stores in many browsers and mail applications through standardized interfaces. Also, with some banking standards like FinTS smart card support is included in applications supporting them.
Jun
18
awarded  Citizen Patrol
Apr
16
comment How are two systems able to set up a secure SSH tunnel over a public connection?
It is worth mentioning that SSH has not been using Diffie-Hellman key exchange before v2 and that TLS/SSL also not necessarily is using it but might be (and often is) configured to simply choose a random value at the client as the secret key and send it to the server after encrypting it with the server's public key. This is obviously less secure as the DH key exchange, but is often chosen over DH due to compatibility issues and the higher computational overhead of DH on the server's side.
Jun
26
answered Does a commercially available self destructing HDD (set in BIOS) exist?
Jun
26
comment Somebody bumped into me, next day my storage unit was burglarized
What kind of a security concept is this? Allowing entrance just with data off a magnetic stripe without an accompanying secret? Having the same data stored in plain and without cryptographic safeguards available through RFID? A "masked person" entering the hallway without anybody paying attention?
Mar
28
comment Would it be possible to overload a large part of the internet, and if so then how?
The troublesome fact is that you would not need all that much. The DNS amplification attack performed has an excellent yield ratio of 50x or more, so with just a 100 Mbps upstream (which is a thing a single $5/month VPS would give you) you could induce 5 Gbps of traffic on the net directed to your victim(s). See blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack
Jan
28
answered Can I determine if my computer has a key logger installed?
Jan
28
answered Reverse-engineering one-time passwords for two-factor authentication systems
Jan
26
awarded  Teacher
Jan
26
answered Can accounts still be logged onto if Password Caching is not enabled?
Oct
24
awarded  Supporter
Oct
24
comment What file formats are known to be unsafe?
The polyglot aspect is interesting, especially when considering the fact that Windows APIs would guess file types. Nontheless, the very definition of "dangerous" is problematic in regard to computer security - without having constructed an attack tree with possible threats for a particular system (or at least having a vague idea of how it might look like) there is no spoon.
Sep
25
comment How will users know if their session is DNSSec protected or not?
The power belongs to the authorities since they are, well authorities. Where else should it be? Aside from that, a true killer application for DNSSEC, much more than server certificates, would be mail certificates. But the very idea of storage of certificates external to DNS within DNS zones is heavily opposed by the responsible IETF workgroup due to the fact that "DNS should not be cluttered by stuff that can be done outside of DNS".
Sep
14
answered What to do about websites that store plain text passwords