3,048 reputation
415
bio website plokta.com
location Canterbury, United Kingdom
age 51
visits member for 4 years, 4 months
seen May 21 at 20:56

May
11
comment How are digital certificates compared?
If a virus has control of your computer, there's no such thing as a secure Java applet. It can install its own Java VM if it wants to. Once again, the only way to be secure is not to catch a virus.
May
11
comment How are digital certificates compared?
Getting a virus is a big problem, and completely compromises everything you do on your computer. The possibility that a virus could install a fake root certificate isn't a big problem, because everything you do is already compromised, and so the fake root certificate doesn't add to your problems.
May
11
answered How are digital certificates compared?
Apr
18
answered Do search engines give searcher's IP address to sites that come up in search?
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell There is no real-world use case for accessing a TLS/SSL site by IP address, except possibly security testing.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell No, it's not trivial to MitM. Because the user should give up and go away at this point. If you can't access a site using a hostname that its certificate is valid for, you shouldn't be accessing it at all. The fix for your "problem" is simple; never use IP addresses for HTTPS connections, even if that's the only way you can connect.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell What I'm saying is that if you access a secure website with the wrong name, whether that's an IP address or an alternative hostname, then the site should not be considered secure even if it happens to be secure on this occasion. The use of the certificate is the same as it would be for a real attack; to tell you that you should not consider this session to be secure, even if it is.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell No, the user knows not to accept the certificate. Unless you're an extremely sophisticated user, or you're doing something weird, the rule is that if the browser gives you a warning, you are not secure and should not proceed. The certificate has done its job, which is to warn the user of the presence of the attacker.
Apr
13
answered Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Mar
25
comment How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?
"Systems commonly affected by malicious software" is a way of saying "Microsoft Windows" without appearing partial or getting sued by Microsoft.
Mar
9
comment Feasibility of creating an in-memory web app (that runs from a CD-rom on a web server) for sharing self-destructing messages
The difficult bit about creating self-destructing messages isn't preventing the server from keeping a copy. It's preventing the recipient from keeping a copy. How will you stop the recipient from copy-and-pasting the message, or taking a screenshot of it?
Mar
7
comment Does OpenSSH use export ciphers?
possible duplicate of OpenSSH default/preferred ciphers, hash, etc for SSH2
Mar
3
answered How does Android L achieve strong encryption with a low entropy passphrase?
Mar
3
answered One Time Password via Text Message: Possible exploits?
Mar
2
awarded  Nice Answer
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
That's a separate question, and should be asked as such, not hidden down here in the comments.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
If you want to hide your data from anyone seeing it, physically destroy the drive it's stored on and scatter the fragments. Of course, you yourself are included in "anyone". If you want to stop anyone except yourself from seeing it then deniable hidden volumes are probably the easiest way -- but don't forget your passwords. If you store them anywhere then that's your weak link rather than the file encryption.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
@Jack A deniable VeraCrypt volume is apparently just random data, with no indication that it's encrypted. It could equally well be an unused volume that has been put through a secure-erase process to write random data to it. You can see the space, but you can't tell that it's encrypted data. Furthermore, VeraCrypt volumes contain random data in their unused space. That random data can be a second hidden volume with a different password. After you've provided the first password for the visible volume, there's no way to tell if the unused space on it is a second volume or just unused space.
Mar
1
answered VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
Mar
1
comment Does Google hand over captcha IPs to webmasters?
What is your evidence that Google gets Tor users' real IP addresses? The article you linked to says nothing about Tor, it just makes a vague statement that Google is using the IP address as part of its bot detection algorithms. That statement does not mean that Google has some way to get the real IP address of a user who is behind Tor, a proxy or a VPN.