peter487

3 ms·

1.
by peter487 13y ago
Raw decode of the cert that has been blacklisted. http://pastebin.com/4wJXTsR4 Let the speculation begins.
2.
by peter487 13y ago
He is probably using some encryption technique which requires multiple keys to unlock, perhaps similar to https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing
3.
by peter487 13y ago
"Decryption" would be my guess. I don't buy the explanation WaPo offers for "Protocol Exploitation" because the name itself is so suggestive...
4.
by peter487 13y ago
It gives you the ability to modify the app without changing its cryptographic signature. If such problem would exist in standard PC world, it would essentially give you the ability to modify the binary without changing its hash. This is a m
5.
by peter487 13y ago
https://github.com/ioerror/duraconf might answer some questions...
6.
by peter487 13y ago
Yes you are wrong :D If NSA is not actively man-in-the-middling you, Perfect forward secrecy still works. ECDHE has been in Openssl since version 1.0.0 so its out there just not used. Btw. Is there any addon for Firefox that shows the “encr
7.
by peter487 13y ago
It has been discussed over and over on hackernews recently so just tldr version. Let’s consider two scenarios. 1) NSA forces CA to issues a certificate for google.com and decide to man-in-the-middle you. In that case there is a mechanism ca
8.
by peter487 13y ago
Not by default on every account. I have recently changed settings on couple of my friends account to force SSL.
9.
by peter487 13y ago
I am not sure if such system existed in the past or if I read about it in some sci-fi book, but it worked as follows: You generated your key pair. In (almost) every country in almost every city there were “key signers” (basically trusted me
10.
by peter487 13y ago
Probably not gonna happened, but it would solve so many problems with public key crypto. Key distribution? No problem, tie your public key to your gmail account. Need to communicate with someone? Just send them your public key. Goole would