540 reputation
213
bio website
location
age
visits member for 2 years, 2 months
seen Feb 27 at 23:42

Feb
26
comment SSL fingerprint inconsistency: what does it mean?
Thanks, I have to wait 11 hours to award the bounty, thanks for your dedication, things are clearer in my head. I don't need papers or references anymore, it's just logical. It makes even more sense now that I remember that one can easily disable a host from a pool of servers, quickly disabling affected servers. Response time is thus improved while keeping availability and making maintenance easier.
Feb
26
accepted SSL fingerprint inconsistency: what does it mean?
Feb
26
revised SSL fingerprint inconsistency: what does it mean?
added 423 characters in body
Feb
26
comment Public key system confusion
With all due respect, I'd rather not share my email address. I help people here when I ask a question usually, and when I'm done, I'm out of here. Besides, many other members are at least as competent as I am, I don't deserve such attention... Thanks though.
Feb
26
answered Why would someone register a Facebook account with a stolen email address?
Feb
26
comment SSL fingerprint inconsistency: what does it mean?
I understand. I just wonder, if there is a failure concerning one cert, MITM attacks are possible on everyone visiting facebook, so it doesn't improve security in this case, right? In either case, you have to wait for the revocation and change certificates. If one cert leaked, why not the others? Since it's the same setup, it's very likely. A set up where spare cert are kept hidden is more secure. It's only in the best case scenario that multiple cert are useful (isolated failure), and certs have to be changed, changing 10 or 200 hosts' cert shouldn't take a lot of time. Does this make sense?
Feb
26
comment Public key system confusion
You don't decrypt it, you verify the signature. It's different. For this case, you use hist public key. For decrypting, you use your private key.
Feb
26
comment How to refute “don't use internet if you don't like it” answer?
To enforce such policies, websites make user sign in, read and understand the ToS and confirm. It's a contract between the user and the service provider. So if he's still saying such BS, you can always go to court and prove him wrong/stupid. It's legal stuff, not related to the Internet.
Feb
26
comment SSL fingerprint inconsistency: what does it mean?
As a side note, "OCSP can be vulnerable to replay attack", it seems that using an old revoked certificate is still possible for a MITM attacker. Just thought it might interest future readers. But let's not talk about it anymore. It's not the point.
Feb
26
answered Public key system confusion
Feb
26
awarded  Critic
Feb
26
revised SSL fingerprint inconsistency: what does it mean?
added 678 characters in body
Feb
26
comment SSL fingerprint inconsistency: what does it mean?
@YoavAner: As I understand (tools.ietf.org/html/rfc3280#section-3.3), each CA maintains a public repository with a CA revocation list, basically listing each revoked certificate by serial number. Then each browser uses the OCS protocol to retrieve it (tools.ietf.org/html/rfc2560). So it's fast (1-2hours), I agree. But how about keeping the spare certificates and not deploy them randomly inside a cluster? This way you can be sure that they didn't leak. If one cert has leaked, why not the others? How facebook's methods does actually improve security?
Feb
26
comment SSL fingerprint inconsistency: what does it mean?
This looks very correct. I edited my question over time to ask what potential benefits such a set up can bring from a security point of view. Do you know any paper or public recommendation that talks about multiple certificates? Surely if it's a good practice there should be some kind of paper/presentation about it.
Feb
26
revised SSL fingerprint inconsistency: what does it mean?
added 314 characters in body
Feb
26
awarded  Promoter
Feb
24
answered Can I detect a MITM attack?
Feb
24
revised SSL fingerprint inconsistency: what does it mean?
added 537 characters in body
Feb
23
awarded  Student
Feb
23
awarded  Commentator