meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 6 months |
| seen | 2 days ago | |
| stats | profile views | 5 |
|
May 10 |
comment |
Is OpenGL a security problem? Very interesting - I knew that it was hard to access the GPU over remote login sessions, but never suspected the reason was security... I also mostly agree with respect to exploiting the GPU being harder than exploiting user carelessness, but still, there is an important distinction - cautious users CAN verify the permissions before installing, but there is no permission for OpenGL. |
|
Jul 19 |
comment |
Can an intermediate CA be trusted like a self-signed root CA? Yes, they do. So it really is by design that the clients refuse to use the intermediate certs as roots of the validation process? Is that a consequence of the chain always being anchored by the root CA? |
|
Jul 12 |
comment |
Is there a way to mitigate BEAST without disabling AES completely? Are you serious? TLS 1.1 will only be supported in the upcoming version 21 of Chrome and is not supported in Firefox, and I don't even want to begin to research the state of TLS 1.1 support on mobile devices. |
|
Nov 4 |
comment |
Are WPA2 connections with a shared key secure? Actually, I'm wondering why the designers of 802.11 didn't use DH in WPA. It would require an active man-in-the-middle attack to recover the PTK, as opposed to just passive sniffing. Maybe they thought that it would just give users a false sense of security? |
|
Nov 3 |
comment |
Are WPA2 connections with a shared key secure? Correction: Actually it's the PTK (pairwise transient key) that is derived from the PMK during every authentication of a client. The PMK is just a hash of the PSK and the SSID. But it's still as I said above; it's enough to record the handshake and know the PSK to know all the keys between an AP and a client. |
|
Nov 3 |
comment |
Are WPA2 connections with a shared key secure? No, you need to collect the key exchange for all the clients you want to listen in on. The key exchange is where the pairwise master key is derived from the PSK. |
|
Nov 3 |
comment |
Are WPA2 connections with a shared key secure? As long as the key echange is part of the collected packets and the PSK is known, it should work for an arbitrary number of clients. |
|
Nov 2 |
comment |
Are WPA2 connections with a shared key secure? Setting up a fake access point will not work. Since the clients are configured to use a network with WPA encryption, they will never associate with an access point that has no encryption or uses a different encryption key. In that respect, WPA-PSK provides mutual authentication between the client and the AP in addition to encryption. |
