reedloden

7 ms·

31.
by reedloden 12y ago
Hopefully, the 'salt' passed to HMAC-SHA256 is a pepper (preferably stored outside the database), not the same user salt as what bcrypt uses. As for scrypt, it definitely has great potential, but I still feel it's too new and
32.
by reedloden 12y ago
Folks on oss-security are skeptical about this (and rightly so, since posts like this have been showing up regularly since heartbleed). http://seclists.org/oss-sec/2014/q2/246
33.
by reedloden 13y ago
Can anybody explain what exactly is happening? The PoC is really hard to read and understand.
34.
by reedloden 13y ago
How does their "Updated Cert?" check work? If it's just checking notBefore, it's going to have a ton of false negatives, as a lot of CAs are just re-issuing certs using the original notBefore.
35.
by reedloden 13y ago
ELBs have terrible TLS support... Cipher suite choice and ordering support is abysmal, and they only recently started supporting newer TLS versions. OCSP stapling isn't supported either. https://wiki.mozilla.org/Securit
36.
by reedloden 13y ago
Firefox 14? If that's correct, does your company understand it's vulnerable to numerous security vulnerabilities by being so far behind (especially ones that could remotely compromise your entire system)? If they need to better ma
37.
by reedloden 13y ago
Is this only affecting Level3's 4.2.2.x nameservers (when it happens), or are their 209.244.0.x ones doing this as well?
38.
by reedloden 13y ago
Why do you turn off the CAMELLIA ciphers?
39.
by reedloden 13y ago
I'm curious why CloudFlare includes !EDH as part of their cipher suite options... Guessing they were just following the recommendations from https://community.qualys.com/blogs/securitylabs/2011/10/17
40.
by reedloden 13y ago
Only the HTML version of the newsletter uses tracking links. If you want "tracking-free" e-mails from Mozilla, sign-up for the plain text version. See https://bugzilla.mozilla.org/show_bug.cgi?id=772788 for detail