19,964 reputation
bio website faiumoni.de/de/start.html
location Germany, Europe
age 34
visits member for 4 years, 7 months
seen Jun 10 at 10:01

My main focus is on security and privacy aspects in the areas of business web applications, databases and online games. I like to look further and see the whole picture.

comment Why is there no Domain CA?
@pacerier www.startssl.com to name the one, I use.
comment Why is there no Domain CA?
@pacerier all CAs only offer certificates that are limited in time before they need to be renewd. There is no difference in principle between free and paid certificates. Except that I am only aware of free certificates that need to be renewed after one year but the are paid certificates that are valid for up to 5 years.
comment Asymmetric vs Symmetric Encryption
Symmetric crypto does depend on the secure exchange of keys. My point is this: Assuming you have such a secure channel, you can use it to exchange public keys as well. Asymmetric crypto does add additional possibilities by involving trusted third parties, but you do not need to use third parties. Other advantages still apply: e.g., You can sign messages to protect them against modifications. You can just pick your private key to decrypt any message sent to you without having to look for the right key. Disclosing public keys is not an issue...
comment Asymmetric vs Symmetric Encryption
If you have a secure channel to share symmetric keys, you can also use that to share public keys. Public/private key crypto adds the additional possibility to attach information about the owner to a public key and let trusted party sign this information.
comment When generating CSRF token
I think your summary is accurate.
comment Using my own encryption instead of https in app
There are certification authorities which offer simple server certificates free of charge. Startssl ist trusted by all major browsers.
comment Using same CSRF Token for Multiple account creation
@Xander, depending on the situation this may be an issue because the IP-address in the server log files will not point to the attacker but to the victim. This is assuming that the CSRF token is not logged. For example an attacker is able to frame a victim by letting his browser create an account and access some illegal information (e. g. copyright violation or worse).
comment Is 'Forge' Javascript crypto library secure?
@FrancisSnipe, keep in mind that you need a secure way (e. g. https) to transmit the html and javascript code to the client. Otherwise an attacker can add some code to send a copy of the unencrypted data elsewhere.
comment Can you generate Diffie-Hellman parameters quickly
Crypto.SE does not want questions about programming. I suspect there is an issue with the random number source.
comment How to stay anonymous in public wireless network?
Google cookies and the unique identifier used by e. g. Firefox to download the list of malicious sites in segments are further identifiers.
comment What's the difference between SSL, TLS, and HTTPS?
@thejh, oops, good catch.
comment Can we make sure that the new Lavabit certificate is not under control of the FBI?
This reminds me of an old movie in which the terrorist holds a gun towards the head of the president's daughter behind the camera.
comment Is there a way to block Ultrasurf OR can I have McAfee nuke it?
Hello Monsuco and welcome to Security.SE. Unfortunately it almost impossible to protect computers to which adversaries have physical access to. Furthermore, your adversaries have a lot of time, motivation and probably technology skills. I suggest to approach this issue from a social angle: Create a set of rules for acceptable use of school property with realistic (!) consequences for concrete types of misuse.
comment Wildcard SSL Certificates & SAAS
Related: What vulnerabilities could be caused by a wildcard SSL cert?
comment LDAP vs MySQL for Usernames and Passwords
One very common mistake with authenticating against an LDAP server is not paying attention to anonymous binds. Many LDAP servers return success on an authentication attempt with an empty password, regardless of the username.
comment What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Mr. Alien, I think this is a very valid question and therefore I prefer not to delete it. I removed the reference to a hash-function which is not suitable for hashing password. This may be one of the reasons for the downvotes. Please have a look at security.stackexchange.com/q/15910/665 regarding password hashing algorithms.
comment Block all kind of querys from ip
It may be a good idea to let the switches do this work because they know if there is a device connected and what mac address it has.
comment Response to script-kiddies “scanning” website for vulnerabilities?
Not all of those are actively done by people, but by worms trying to spread themselves.
comment XSS prevention through Content Security Policy
CSP was designed to allow trusted JavaScript not to forbid JavaScript entirely. If you stick with modern best practices (e. g. no intervening of JS and HTML), very little or even no changes are required.
comment When to use SSL ? / When to send passwords via mail?
You can get SSL certificates, that are accepted by all common browsers, free of charge.