93,209 reputation
10134257
bio website
location
age 69
visits member for 3 years, 8 months
seen 2 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


2h
comment How do I know if a font is malicious?
Would a location become trusted because "an Internet bear said so" ?
Jun
29
awarded  Nice Answer
Jun
29
awarded  Necromancer
Jun
25
awarded  Good Answer
Jun
23
awarded  Nice Answer
Jun
23
comment How critical is it to keep your password length secret?
Modern fashion with TLS is to use AES/GCM cipher suites, where there is no padding -- the plaintext length can thus be inferred with the utmost precision.
Jun
23
answered How critical is it to keep your password length secret?
Jun
23
awarded  Nice Answer
Jun
20
awarded  authentication
Jun
18
comment Why is it fine for Certificates above the end-entity certificate to be SHA1 based?
There is some embryonic standard somewhere, that somehow alludes to the interpretation of a self-signed certificate as a trust anchor, but this is as part of "trust lists" to be used with long-term signatures, and I don't think it is much supported anywhere. The Tradition predates it by at least one decade.
Jun
18
comment Compromised Issuing CA
We are here talking about an offline root CA, which, by definition, cannot be an online responder. Moreover, an OCSP response still has a lifetime; while any relying party MAY insist on getting a fresh response (freshness is verified with the nonce), the question is about OTHER machines -- such freshness cannot be enforced externally.
Jun
18
awarded  Great Answer
Jun
18
comment Why is it fine for Certificates above the end-entity certificate to be SHA1 based?
Well, it is not urgent -- SHA-1 is not broken yet -- but yes, if there is a problem with SHA-1 then it is not limited to end-entity certificates.
Jun
18
answered Compromised Issuing CA
Jun
18
answered Why is it fine for Certificates above the end-entity certificate to be SHA1 based?
Jun
17
comment Is it possible to encrypt a download twice, once with a different encryption method?
Encryption does not prevent tampering. To reliably detect tampering, you need a MAC.
Jun
17
comment SSL is Extended Validation more secure?
The idea of EV vs non-EV certificate is that the attacker is assumed to be able to obtain a fake non-EV certificate from an existing CA -- and then, there will be no warning to click through. Browsers don't allow users to "click through" warnings about purportedly EV certificates that don't validate cleanly (and that's, in some way, about protected users from themselves), but then the attacker won't present a fake EV certificate, avoiding this issue.
Jun
17
answered SSL is Extended Validation more secure?
Jun
17
answered Which strategy to encrypt data accessed by multiple users?
Jun
17
awarded  key-exchange