140,919 reputation
22281486
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 3 years, 8 months
seen 1 hour ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Aug
8
comment Why IE/Windows forces you to install self-signed certificates as root CA to make them work?
On Windows systems, each user has its own set of "certificate stores". There is also an extra set attached to "the local machine". Only Administrator can write in the latter, but every user can add certificates in his own "root CA" store and this will work for his process. As for the lack of Basic Constraints, this is equivalent to an extension stating that the certificate is not a CA, so as long as the certificate is v3, this is fine (if the certificate has an extension, it is v3: v1 and v2 format don't have extensions).
Aug
8
awarded  Nice Answer
Aug
7
reviewed Leave Closed Does adding an extra, non-entropic keyfile lower security?
Aug
7
answered Pin + guid in URL secure for a web app?
Aug
7
answered Are there any guidelines for passwords that need to be read out loud?
Aug
7
answered Recommended options for LUKS (cryptsetup)
Aug
7
revised Why IE/Windows forces you to install self-signed certificates as root CA to make them work?
edited tags
Aug
7
answered Why IE/Windows forces you to install self-signed certificates as root CA to make them work?
Aug
7
revised Is there an SSL Certificate state-cache on Windows, IE, and Outlook and how it it managed?
edited tags
Aug
7
answered Is there an SSL Certificate state-cache on Windows, IE, and Outlook and how it it managed?
Aug
7
comment Does adding a non-entropic part to a password makes it less secure?
Entropy is a property of the password generation process, as the attacker knows it. You cannot calculate or even define the entropy of a password "alone".
Aug
6
answered Does adding an extra, non-entropic keyfile lower security?
Aug
6
answered Does adding a non-entropic part to a password makes it less secure?
Aug
6
comment BREACH - a new attack against HTTP. What can be done?
The idea is that the attacker can inject his Javascript in a HTTP page from another site, and the Javascript then proceeds to make your browser send requests to the target HTTPS server. Because of the Same Origin Policy, the Javascript cannot send arbitrary requests to the target HTTPS site (in particular no POST), but it can send basic GET requests by manipulating the DOM and adding some <img> tags.
Aug
6
comment ISMS for SMB (Small And Medium Enterprise)?
Well, after explaining that ISMS tools don't actually help in managing information security in small organizations, I certainly won't list tools which help, since there are none.
Aug
6
answered ISMS for SMB (Small And Medium Enterprise)?
Aug
6
answered Ban or delete abusive users
Aug
6
answered Import Public Private key pair to a Keystore
Aug
6
comment Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint?
Indeed. I have added two paragraphs to cover that case also.
Aug
6
revised Is initializing variable to NULL or 0 or -1 a bad practice from security standpoint?
added 882 characters in body