280 reputation
310
bio website
location Queensbury, NY
age 30
visits member for 2 years, 10 months
seen Apr 23 at 18:52

Java generalist, interested in security (appsec/websec), performance/tuning/gc and concurrency.


Jul
2
accepted Open Source Vulnerability Scanner
Jul
2
asked Open Source Vulnerability Scanner
Jul
2
asked Types of attacks outside of AppSec and Vendor-Specific Systems?
Jul
2
accepted OWASP Top 10? How about OWASP Top 1000?
Jul
2
comment OWASP Top 10? How about OWASP Top 1000?
Awesome answer - thanks @Rory - I figured CVE would crop up in some answers and this was just the kind of structure I was looking for. Thanks again
Jul
2
asked OWASP Top 10? How about OWASP Top 1000?
Jul
2
asked How do I use OpenSSL with the Java Keytool?
Jun
28
accepted Inner Workings of Public Key Encryption
Jun
28
comment Inner Workings of Public Key Encryption
Wow - fantastic answer (+1). So is this "secret key" the message that is encrypted, or is it yet another key for decrypting the message? If the latter is the case, then if I understand your answer, asymmetric public/private keys are used for transmitting symmetric secret keys, which are then in turn used to encrypt/decrypt messages. Yes, no? Thanks again!
Jun
28
accepted What does it mean for a digital certificate to be “signed”?
Jun
28
accepted Purpose and Uses of Root SSL Certificates
Jun
28
comment What does it mean for a digital certificate to be “signed”?
Thanks @Oleksi - but I think you misunderstand what my question was! You say "To do this, they use their signing key to sign the certificate." I don't understand what the "signing" part is!! Are they encrypting the cert with their signing key, or are they adding their signing key to the cert? Thanks again (and +1)!
Jun
28
comment Purpose and Uses of Root SSL Certificates
Thanks @Mike Scott - so let me see if I understand you: (1) If I want to be the CA for my own private network, I obtain a root SSL from, say, a company like VeriSign, and that root gives me the ability to generate my own "normal" (end-user) certs or chained certs (which end up being end-user certs); and (2) since client browsers will not have my CA in their registries, I need to figure out a way to get them to trust me. Please correct me if any of this is wrong, and if you don't mind telling me, what are my options for setting up this "secure delivery channel" as you mention? Thanks (+1)!
Jun
28
asked What does it mean for a digital certificate to be “signed”?
Jun
28
asked Inner Workings of Public Key Encryption
Jun
28
asked Purpose and Uses of Root SSL Certificates
Sep
21
awarded  Supporter
Sep
21
awarded  Student
Sep
21
awarded  Scholar
Sep
21
accepted Appsec Standards Organizations?