113 reputation
6
bio website
location Baltimore, MD and New York, NY
age
visits member for 2 years, 4 months
seen Mar 3 at 3:00

Nov
19
comment nmap on my webserver shows TCP ports 554 and 7070 open
+1 for crappy FiOS Actiontec router. I know your box's private keys (so do others, thanks to Little Black Box).
Oct
7
awarded  Excavator
Oct
7
revised “Countersigning” a CA with openssl
Use 'example.com'; that's what IANA reserves it for. 'mydomain.com' is a real domain owned by a real organization.
Oct
7
comment “Countersigning” a CA with openssl
"subdomains... currently present their own self-signed certificates. We're tired of having to accept exceptions in Chrome" - Chrome has probably stopped accepting them (Sept 2014). You need to have the server certificate signed by a CA. Its OK if its a private CA. But no more self signed certificates.
Oct
7
comment “Countersigning” a CA with openssl
"They'll take any chance they can get to increase their already rather imaginary fees along with a perceived increase in value to the customer" - Haha! (but so true). Peter Gutmann calls it PKI-me-harder.
Oct
7
comment “Countersigning” a CA with openssl
CN=*.example.com - placing DNS names (like *.example.com) in the CN is deprecated by both the IETF and the CA/B Forums. Instead, place a friendly name in the CN like My Domain, and place DNS names in the SAN. There are some other rules that an operator must follow if they insist on putting DNS names in the CN. Recent version of Chrome (Sept 2014) will refuse to load the site if the CN contains a DNS name without following the additional rules placed by the CA/B Forums. Firefox will likely follow suit soon. (Browsers follow CA/B Forum policies; and don't honor IETF policies).
Oct
7
suggested approved edit on “Countersigning” a CA with openssl
Sep
30
comment How to check if a RSA public / private key pair matched
The cited question states to use OpenSSL commands. Unfortunately, those commands don't call their own relevant APIs, like DSA_check and RSA_check. The commands just parse and print. And if you check the return value from the openssl dsa ..., you will find that it returns 1, which is failure.
Aug
9
comment Unable to generate certificate with Subject Alternate Name using Java 1.7 keytool utility
"CN=spam.example.com" - placing a DNS name in the CN is deprecated by both the IETF and the CA/Browser Forums. Instead, put a friendly name in the CN like "Spam Inc". Put all DNS names in the SAN.
Apr
27
revised Heartbleed: What is it and what are options to mitigate it?
Added info on timeline and discoverers.
Apr
27
revised Heartbleed: What is it and what are options to mitigate it?
Added ref to OpenSSL SECADV 2014047 and CVE-2014-0160.
Apr
12
revised Heartbleed: What is it and what are options to mitigate it?
Added info on scuzzy-delta's remediations (includes reset server session and passwords).
Apr
12
revised Heartbleed: What is it and what are options to mitigate it?
Added info on Cloudfare challenge.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
Added info on Intelligence Community denial of Bloomberg's report.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
X.509 private key -> private keys, shared secrets, preshared keys; Moved remediation steps under the remediation secition; Moved "Systems Administrators need to *assume* ..." under Concerns section.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
Added info on Bllomberg's report on the NSA's weaponization of the vulnerabiltiy.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
Added info on governance/proceses; and info on IETD TLS WG discussion.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
Added info on checking version numbers and backpatching.
Apr
11
revised Heartbleed: What is it and what are options to mitigate it?
Added link to commit that introduced vulnerability; Added link to Seggelmann's denial; Added link to active exploit evidence; Improved flow in one area; One spelling correction.
Apr
11
comment Heartbleed: are services other than HTTPS affected?
"secure SMTP, IMAP etc" - yes. And SPDY too. Anything that uses OpenSSL and TLS for the socket security. "OpenVPN, OpenSSH, etc" - no, they are different protocols.