2,968 reputation
415
bio website plokta.com
location Canterbury, United Kingdom
age 51
visits member for 4 years, 3 months
seen 13 hours ago

Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell There is no real-world use case for accessing a TLS/SSL site by IP address, except possibly security testing.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell No, it's not trivial to MitM. Because the user should give up and go away at this point. If you can't access a site using a hostname that its certificate is valid for, you shouldn't be accessing it at all. The fix for your "problem" is simple; never use IP addresses for HTTPS connections, even if that's the only way you can connect.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell What I'm saying is that if you access a secure website with the wrong name, whether that's an IP address or an alternative hostname, then the site should not be considered secure even if it happens to be secure on this occasion. The use of the certificate is the same as it would be for a real attack; to tell you that you should not consider this session to be secure, even if it is.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@SonnyOrdell No, the user knows not to accept the certificate. Unless you're an extremely sophisticated user, or you're doing something weird, the rule is that if the browser gives you a warning, you are not secure and should not proceed. The certificate has done its job, which is to warn the user of the presence of the attacker.
Apr
13
answered Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Mar
25
comment How to pass PCI DSS 2.0 anti-virus requirement (5.1) on Linux?
"Systems commonly affected by malicious software" is a way of saying "Microsoft Windows" without appearing partial or getting sued by Microsoft.
Mar
9
comment Feasibility of creating an in-memory web app (that runs from a CD-rom on a web server) for sharing self-destructing messages
The difficult bit about creating self-destructing messages isn't preventing the server from keeping a copy. It's preventing the recipient from keeping a copy. How will you stop the recipient from copy-and-pasting the message, or taking a screenshot of it?
Mar
7
comment Does OpenSSH use export ciphers?
possible duplicate of OpenSSH default/preferred ciphers, hash, etc for SSH2
Mar
3
answered How does Android L achieve strong encryption with a low entropy passphrase?
Mar
3
answered One Time Password via Text Message: Possible exploits?
Mar
2
awarded  Nice Answer
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
That's a separate question, and should be asked as such, not hidden down here in the comments.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
If you want to hide your data from anyone seeing it, physically destroy the drive it's stored on and scatter the fragments. Of course, you yourself are included in "anyone". If you want to stop anyone except yourself from seeing it then deniable hidden volumes are probably the easiest way -- but don't forget your passwords. If you store them anywhere then that's your weak link rather than the file encryption.
Mar
1
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
@Jack A deniable VeraCrypt volume is apparently just random data, with no indication that it's encrypted. It could equally well be an unused volume that has been put through a secure-erase process to write random data to it. You can see the space, but you can't tell that it's encrypted data. Furthermore, VeraCrypt volumes contain random data in their unused space. That random data can be a second hidden volume with a different password. After you've provided the first password for the visible volume, there's no way to tell if the unused space on it is a second volume or just unused space.
Mar
1
answered VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
Mar
1
comment Does Google hand over captcha IPs to webmasters?
What is your evidence that Google gets Tor users' real IP addresses? The article you linked to says nothing about Tor, it just makes a vague statement that Google is using the IP address as part of its bot detection algorithms. That statement does not mean that Google has some way to get the real IP address of a user who is behind Tor, a proxy or a VPN.
Feb
20
awarded  Nice Answer
Feb
20
comment Can serving HTTPS to Internet Explorer on Windows XP be made secure?
You're asking the wrong question. It's not about how Windows XP can be made secure -- it can't. The question is, would you rather that people using Windows XP use your site with possible security issues, or don't use your site. If you're a bank, you might decide to go for the former option, but most people will go for the latter in order to keep their users.
Feb
19
answered Is “password knocking” a good idea?
Feb
16
answered What happens when encrypting with private key?