Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
7
Newest
 Commentator
Impact
~11k people reached

Jan
20
awarded  Commentator
Jan
20
comment How should I securely type a password in front of a lot of people?
Instead of this, I'd suggest programming a Yubikey with a static random string. The Yubikey simply emulates a keyboard. Append the string to the password you have memorized. When you need to enter your password, first type the part from memory, then insert the Yubikey into a USB slot and touch the button. It will enter the static string to complete the full password and hit enter. A key is easier to keep on your person and less obvious than scanning a barcode. Here's a tutorial: yubico.com/products/services-software/personalization-tools/…
Jan
20
comment How should I securely type a password in front of a lot of people?
@BlacklightShining Physical access defeats any measure you can take. If you can't trust the machine, there's no way to authenticate yourself to the email service or trust anything.
Dec
17
comment How to replace SSL/TLS?
@blownie55 I agree what we should advise the OP to find a better solution, as many are doing, however Let's Encrypt does nothing to help in that regard. Any cheap SSL certificate would do fine, or even a free one from StartSSL.com. The fact that Let's Encrypt is now available and is free is very nice but ultimately not the issue here. You're indeed not the only one who suggested it. That doesn't make you right, it makes the other one wrong as well.
Dec
16
comment How to replace SSL/TLS?
@Ohnana Ah, I see. As a way to help him make a business case for an upgrade of the hosting plan. While that may help, free certificates existed before Let's Encrypt, e.g. from StartSSL.com and paid certs start from a few $/yr. Cheaper than even a month of cheap hosting.
Dec
16
comment How to replace SSL/TLS?
That does not answer the question since his hoster does not provide SSL/TLS support. Whether the certificate is free or not makes no difference.
Dec
16
comment How to replace SSL/TLS?
Yes, but an HTML5 app would not be secure since there'd be no good way to authenticate, i.e. that your downloading the app from the the correct server and that it is unmodified.
Dec
16
comment How to replace SSL/TLS?
@Ohnana, No, Let's Encrypt is simply a provider of free SSL/TLS certificates. That does not help if the provider used will not allow SSL/TLS.
Dec
1
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
While I'm excited about this development I'm going to state the obvious: Let's Encrypt is not yet available and it remains to be seen if browser vendors, other than Mozilla, will trust its root-certificate. It will not be very useful otherwise, a problem CAcert.org can relate to. In the meantime I'd suggest shopping around for a certificate (or getting a free one from Startcom). They're quite affordable and are currently your best bet.
Apr
26
awarded  Critic
Apr
26
awarded  Editor
Apr
26
revised PHP files browsable: is this a vulnerability?
fixed typo and syntax
Apr
26
comment PHP files browsable: is this a vulnerability?
While your points are valid, none of them answer the question that was asked. The sound more like comments to other people's answers.
Apr
26
suggested approved edit on PHP files browsable: is this a vulnerability?
Feb
18
comment Is anybody using client browser certificates?
That's true, AviD. Of course the kiosk should be properly hardened to prevent that kind of access. If a cert is stolen, it can be revoked individually by the CA since that kiosk should be considered compromised. In this case the information on the webserver is not critical enough to require additional measures, so the client-cert is basically an alternative to a password.
Aug
7
awarded  Supporter
Aug
24
awarded  Caucus
Jan
4
awarded  Teacher
Jan
4
answered Is anybody using client browser certificates?
Dec
19
awarded  Autobiographer