81,033 reputation
9111216
bio website
location
age 69
visits member for 3 years, 1 month
seen 3 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
@user2813274: there are products that do interception of SSL traffic by generating on the fly a fake certificate and, technically, doing a MitM attack (this of course requires installation of the corresponding CA certificate in the clients). However, this may incur substantial CPU cost on the firewall/filter side, and it breaks client certificates (although this are quite rare in practice).
Nov
5
awarded  Nice Answer
Nov
4
answered My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
Nov
4
comment What would HTTP/2 TLS encryption provide?
The text means that some people insist on being formally allowed to do some HTTP/2 over plain TCP without a TLS layer. However, Firefox and Chrome already decided not to support non-TLS HTTP/2, so life will be hard for sites that use HTTP/2 without TLS. Hence my "somehow mandatory".
Nov
4
answered Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
Nov
4
answered What would HTTP/2 TLS encryption provide?
Nov
4
answered OpenVPN dhparam
Nov
4
comment In OpenVPN, is the dh1024.pem file dependent on the CA?
You should be able to replace it at any time, although you must probably restart the server software to make it take the new file into account. OpenVPN uses a TLS handshake for each new client, and the DH parameters are used by the server (and sent to the client) during that handshake. However, there is little point in changing the file; you can, but there is no known security issue that such a change would solve.
Nov
4
answered In OpenVPN, is the dh1024.pem file dependent on the CA?
Nov
4
answered PGP as method of sharing AES key?
Nov
4
answered How can Tor be considered a standard tool for achieving anonimity, given that it is created by the government?
Nov
3
answered How can the private key be obtained in PKI without alerting a third party?
Nov
3
answered Continued Use of Kerberos
Nov
2
answered POODLE and REST APIs
Nov
2
answered Multi hash security
Oct
31
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
Arguably, if the K_D key is document-specific, then sharing the key and the document are the same thing. One could say that you cannot force somebody to forget a document any more than you can force him to forget a key. In that sense, "revoking" an access is not well-defined.
Oct
31
awarded  Enlightened
Oct
30
comment Why are drives overwritten three times when being disposed of?
But 20 years ago, indeed we were not using Flash drives... However, even for magnetic drives, remanence has reduced a lot because information density has increased; so when the drive is writing a "1" it already gets something in the 0.6 to 1.8 range or something like that. The small differences that remanence relies upon have been exploited to store more bytes in the disk. That's how we get disks with terabytes of data nowadays.
Oct
30
awarded  Nice Answer
Oct
30
answered Why are drives overwritten three times when being disposed of?