731 reputation
411
bio website
location
age
visits member for 2 years, 4 months
seen Apr 9 at 11:59

Feb
25
comment How to prevent access to website without SSL connection?
@AnnonomusPerson, that's exactly the same principle and that's what the rewrite rule from HTTP to HTTPS does. Whether you do it programmatically or by configuration doesn't matter, it's still a redirection with an initial request in plain HTTP, which presents the same problem.
Nov
24
awarded  Yearling
Oct
28
awarded  Announcer
May
6
awarded  Nice Answer
Nov
24
awarded  Yearling
Aug
1
comment What books or articles are must reads for learning about SSL management
Which specific aspect of managing certificates for SSL are you interested in? Is it more about how certificates work in general or perhaps some best practices (in terms of system administration)? Is it a wider question in terms of how to set up an HTTPS website properly?
Jul
30
comment Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Which tool do you use to generate your self-signed certificate?
Jul
30
answered Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, after re-reading your comment at the top, this should be of interest (if you haven't seen it already from the other question I've linked to).
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, indeed, that makes sense if their CDN have the same URL mapping between http:// and https:// (I was just pointing out that they were offering https:// here).
Jul
26
comment https (SSL) instead of http for mobile users
No, they can't. I connect to my bank website using https://mybank/ directly, and I don't ignore certificate warnings: sslstrip doesn't work here. Again, sslstrip attacks the content obtained via plain HTTP, to prevent you from getting the https:// links (or rediction). If you expect HTTPS for a site, you're OK. Again, that's why HSTS (HTTP Strict Transport Security) is being deployed, to make sure browser expect HTTPS when it's available.
Jul
26
comment https (SSL) instead of http for mobile users
From the sslstrip page: "It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links.". That's an attack against upgrades and initial HTTP content, not against HTTPS. That's why HSTS is useful.
Jul
26
comment https (SSL) instead of http for mobile users
You don't seem to know how sslstrip works. It MITM-attacks the HTTP connection before getting to HTTPS, for those who rely on an upgrade, or spoofs the cert with its own (which you won't trust). If you expect HTTPS to start with, and if you get a certificate you trust, you're OK.
Jul
26
answered https (SSL) instead of http for mobile users
Jul
26
comment https (SSL) instead of http for mobile users
HTTPS is not vulnerable to MITM attacks, if the user has normal certificate verification in place. That's the whole point.
Jul
24
answered How to reliably determine server stack of a site (eg .Net vs Open Source)
Jul
23
awarded  Constituent
Jul
23
awarded  Caucus
Jun
27
comment Need private personal access to ~three PHP pages
@Lèsemajesté You can download/install your browser from a trusted network (or a trusted source) and use it from another. This is quite typical if you bring a laptop onto a Wifi network that's not under your control. While I agree you should be careful as to where you get your browser from, this is quite a different problem. Not sure the PRNG problem is that easy to fix either. Anyway, since the OP's host provides HTTPS (at least with shared host) on all its shared hosting packages, he should just use that instead of building something weaker in JS.
Jun
27
comment Need private personal access to ~three PHP pages
@Lèsemajesté (1) sure there's a point where you have to trust the browser and the CA certs it comes with, but that's completely different. You can't just say "let's not worry about MITM attacks when getting a webpage because I'm not sure about the browser code anyway". In addition, I got my IE through a genuine MS Win DVD (updates are also signed): unlikely a MITM would have tampered with it. (2) The JS/HTML on a thumbdrive doesn't solve the poor PRNG in browsers (use a full app instead). In-browser JS crypto might be better than nothing... as long as you're not expecting anything serious.