148 reputation
5
bio website
location
age
visits member for 3 years, 4 months
seen Jun 18 at 8:51

Jun
18
comment SSL is Extended Validation more secure?
@MikeOunsworth EV won't pass with a rogue root certificate. EV CA OIDs are separately hardcoded into the browser and don't use the browser's trust store. The browser application would need to be compromised in order to make it shows a green bar, at which point SSL is no longer the primary concern. Of course, the user has to actively look for a green bar for it to be effective.
Mar
9
awarded  Commentator
Mar
9
comment Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?
Windows DPAPI supports additional entropy (i.e. master password) on a per application basis so that the data is not visible to all processes running as the user account. Chrome has to specifically use this mechanism though. OS X's keychain by default only allows the application that created the passwords to access it. Other applications require user confirmation. A separate keychain with a different password can also be used.
Mar
5
comment Why IE/Windows forces you to install self-signed certificates as root CA to make them work?
I have never seen a self-signed certificate used on any website that was specific to the domain name. They are all self signed CAs which are a major security risk if installed in IE / Windows. Firefox still restricts it to that particular domain when you add an exception even if it's a CA.
Mar
5
comment If your company/university requires you to install root certificates what protects you from man in the middle attacks?
@Thijser It's up to the MITM firewall. It may reject it or generate a form asking you to proceed with the request.
Mar
5
awarded  Editor
Mar
5
revised If your company/university requires you to install root certificates what protects you from man in the middle attacks?
added 323 characters in body
Mar
5
answered If your company/university requires you to install root certificates what protects you from man in the middle attacks?
Oct
5
accepted How are “Certificate Signing” key usage certificates restricted to what domains they can sign?
Oct
5
asked How are “Certificate Signing” key usage certificates restricted to what domains they can sign?
Sep
26
comment HTTPS self signed certficiate for personal website
Get a free certificate from StartSSL if you don't want the hassle of manually trusting your own certificate in every browser.
Jun
3
comment Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?
Cisco supports 802.1X trunking with an AP as a supplicant with multiple SSIDs & VLANs right from their SMB 300 series switches and APs.
Jun
2
comment Are Web Views in android secure?
Typing your password into a WebView is the same as typing your password into an unknown app or website. The OAuth procedure to log into Google, Twitter etc. from an app is completely pointless as the app already stole your password when you typed it in. It has complete control over the WebView.
Jun
2
awarded  Scholar
Jun
2
accepted Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?
Jun
2
comment Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?
Also, this is just for a home lab. I am only interested in identifying solutions that are theoretically secure and that don't rely on physical security. If a device is physically compromised, the worst that could be done should be to have its settings erased and thus its saved credentials would be lost. My switch actually does support 802.1X on a trunk port as well as simultaneous VLAN assignment instead of trunking if the RADIUS server specifies the VLAN ID. I was eager to get this working with an AP that supports RADIUS based assignment on the same SSID.
Jun
2
comment Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?
Theoretically it could work on a Linux client by manually running wpa_supplicant twice - First using the wireless driver to authenticate to the AP and once the interface is up, again using the wired driver to authenticate to the switch. Obviously this is not feasible for regular clients unless the OS itself "detects" that the second Ethernet layer authentication is required after connecting to the AP.
Mar
28
awarded  Student
Mar
27
awarded  Teacher
Mar
27
answered SSL is Extended Validation more secure?