chopin

136 ms·

1471.
by chopin 13y ago
Afaik it is not necessary that a root CA is compromised. Sufficient would be to compromise any intermediate CA who is not on a revocation list. How to circumvent Googles certificate pinning in Chrome, I have no good idea. They would need to
1472.
by chopin 13y ago
The documents mention the DigiNotar hack explicitly. What I do not understand is that the hack was detected when (afair) Iranian authorities tried to MITM Google connections, so the hack was claimed to come from an Iranian hacker. This begs
1473.
New NSA Leak Shows MITM Attacks Against Major Internet Services(schneier.com)
656 points by chopin 13y ago|139 comments
1474.
NSA Apparently Undermining Standards, Security, Confidence(freedom-to-tinker.com)
2 points by chopin 13y ago|0 comments
1475.
by chopin 13y ago
DigiNotar
1476.
by chopin 13y ago
Bruce Schneier is pretty bold as well.
1477.
by chopin 13y ago
For end users, this is rather difficult. I maintain a Jetty web server, which is based on Java. The SSL/TLS implementation relies on the cipher suites provided by the JVM. I can restrict Jetty to using ECC as preferred cipher suites bu
1478.
by chopin 13y ago
>A machine can't laugh at your embarrassing confession. Nor can a machine talk about your letter to its friends. To its friends at the NSA? I beg to differ.
1479.
by chopin 13y ago
MD5 message authentication for the site. No PFS (ephemeral key exchange). Mixed content. I couldn't find a statement where the servers are hosted. Not exactly encouraging.
1480.
by chopin 13y ago
Would it be possible to thwart this attack (BREACH) by issuing fresh CSRF tokens for each requests?
1481.
by chopin 13y ago
That's true for almost all side channel attacks using user controlled input (eg. padding oracle attack).
1482.
by chopin 13y ago
Citation, please?
1483.
by chopin 13y ago
With ubiquitous surveillance, there is only little need for regulation.
1484.
by chopin 16y ago
> XML documents should be human-legible and reasonably clear. Yes, that's true, as stated in http://www.w3.org/TR/2008/REC-xml-20081126/#sec-origin-goals . Nevertheless, I stand by my point that human readability does not necessarily i
1485.
by chopin 16y ago
Languages are mainly for humans, not for machines. XML is intended for transporting data machine to machine, not to be read and comprehended by humans. Computer languages must foster the comnprehension by (fellow) developers, this is their
1486.
by chopin 16y ago
Most of my classes are package private. It is just a matter of information hiding. Especially when using factory patterns I hand out only public interfaces whereas the implementations are kept package private.