1,686 reputation
39
bio website plokta.com
location Canterbury, United Kingdom
age 51
visits member for 3 years, 10 months
seen 15 hours ago

1d
comment Why do credit cards have chips, if I can purchase online without the chip being read?
@Sparkler The cardholder is already pretty well protected against card fraud, except for the often considerable nuisance of getting it straightened out. Chip and PIN is about protecting the banks and the retailers, yes. The consumer will benefit in the long run as card processing fees come down and so prices come down a bit.
1d
answered Why do credit cards have chips, if I can purchase online without the chip being read?
1d
answered How to Stop Email Spoofing
Oct
24
comment SSL Asymmetric encryption newbie
While agreeing that you shouldn't be collecting credit card data without a much better understanding of SSL, the missing link you're looking for is that SSL certificates have to be signed by a trusted third party whose public key is distributed with the web browser, and so never passes over the Internet where it could be intercepted. In theory, this prevents site spoofing and man-in-the-middle attacks.
Oct
6
answered PCI Compliance Check-list
Oct
5
comment What steps can be taken to secure snail mail?
@AndréDaniel I think having to scan, OCR and decrypt your snail mail would count as being inconvenienced by security, and so doesn't meet the required conditions.
Sep
15
answered What is cookie reverse engineering?
Sep
4
comment Email address book stolen
If it's a third party authorised by Groupon, then that's still their responsibility. It can't be a third party doing it without Groupon's cooperation.
Sep
4
answered Email address book stolen
Aug
1
answered Using a Public-Key-Encryption browser side to avoid PCI compliance
Jul
8
awarded  Nice Answer
Jul
8
comment Can I use a single SSL cert on two different servers?
... and the users' browsers all support Subject Alternative Name. Not pre-2003 versions of Firefox (called Phoenix back then), Netscape, Opera or Safari, or Symbian 9.1 and earlier. Unlikely to be much of an issue these days, but it could be.
Jul
8
answered Can I use a single SSL cert on two different servers?
Jun
29
answered Given an IP address can you ssh into /tmp without password?
Jun
23
comment what harm can a malicious ca do?
They can do a man-in-the-middle attack against connections that are using perfect forward secrecy as well. Perfect forward secrecy protects you against a later compromise of the legitimate key, but not against a rogue CA signing an illegitimate key.
May
27
comment How Safe Are Encrypted Websites Really?
It depends how you got to Google. If you went to https://www.google.com/ and verified the SSL certificate was OK, then it's OK. If you just entered www.google.com into your browser and went to http://www.google.com/ then in theory that could have been hijacked and returned an attacker's link instead of the real link.
May
20
awarded  Nice Answer
Apr
22
comment How can I create a password that says “SALT ME!” when hashed?
@corsiKa The accepted answer brute-forced "SaltMe" or "SALTME", not the requested "SALT ME!" The difference between 6 and 8 characters is extremely significant here.
Apr
15
answered Are there “secure” languages?
Apr
4
answered Proving SSL need