@D3C4FF Damn! Language barrier. I meant he made our presentations look like shit. Everybody got photos off of Google and I thought I made the best presentation by taking my own photos. Then this guy came with his own slo-mo video.
Also, for the record, if there's somebody that I don't like in chat I click the little block button so that their messages don't show up on my screen. Which also means I don't talk to them and given heartfelt advice on what I think makes for higher quality contributions.
I forgot to handout my tax declaration to my employer. Woke up on Friday morning and opened the mailbox, only to find out that I paid 60% tax this month!
@AviD No, once a year. I was lucky enough to have a problem with my tax return last year, they fixed in February and so I had to make a new declaration on March for 2013
@TerryChia I think he thinks a lot of people on here hate him, while that's not true. Downvoting is not hating, it's just paying shitty answers their due
@TerryChia "come with windows" this is not accurate, Windows searches an online driver database for you. So it's not like it needs to be distributed to every copy of Windows installed...
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple contexts, but given that I could host all of my applications under the same host name I don't see thi...
@AviD I have seen this CD MUST INSTALL behavior as well. In the end you find out all it does it open the admin console that you can always open just by entering the IP in a web browser
@TerryChia Okey spokey. You need to find out (probably from device manager) the device ID for the device. Usually four digits in hex. Might match XXXX:YYYY where both X and Y are hex digits.
@TerryChia If you just talking about home/CTF use, you can also pick up a web managed Dell switch for cheap. Less than $100 US new. Not exactly a data center quality switch, but great features for the money.
@AviD In my experience of pentesting, nobody notices. I had a client once coming in, our security team got you! the noticed you were testing. This was after 3 days of doing constant nmap scans and using Nexpose. It's like badgering with a sledgehammer
@TerryChia Nexpose is nice but way too expensive if you go for the enterprise. Community is restricted to 32 IPs only
@TerryChia the real value of Nexpose is their integration with MSF. Basically you can schedule Nexpose to run scans periodically, import that data automatically in Metasploit, perform exploitation on those vulnerabilities automatically and then give feedback to Nexpose again for a full cycle risk assessment
A "wildcard certificate" is a certificate which contains, as possible server name, a name which contains a "*" character. Details are in RFC 2818, section 3.1. The bottom-line: when the server certificate contains *.example.com, it will be accepted by clients as a valid certificate for any server...
@ThomasPornin I too upvoted (after reading), but I admit I am not yet quite satisfied.
Sure, wildcard certs are bad for the environment. However, the real question - what does it do to my webserver/app/something else - is only partially related by the last paragraph.
Might I dare to poke the bear, and request an elucidation?
That is, if there really are any non-theoretical/philosophical issues.
@AviD I wrote it in the message: the SSL server itself, by construction, is not impacted by whatever is in its certificate, because the certificate is for clients, not for the server.
@ThomasPornin well, yeah, that part was obvious. But when talk about the security of the web/app server, we obviously include its users, and the trust-relationship between them.
@AviD Well, a wildcard is a message from the CA which tells "trust everything, regardless of what appears in the name where the '*' is". It's rather broad. Trust tends to be diluted when it is too broadly applied.
@ribot Session hijacking is another common attack prevented by SSL. Most of the attacks prevented by SSL are of the MITM-variant. — Terry Chia10 mins ago
It's important to understand what SSL does and does not do, especially since this is a very common source of misunderstanding.
It encrypts the channel
It applies integrity checking
It provides authentication
So, the quick answer should be: "yes, it is secure enough to transmit sensitive data...
When using Google through HTTPS, you "benefit" from the automatic tracking of Google by linking your searches with your Google+ profile, Gmail account, Youtube account and similar things. Google is known to try to refine search results depending on who asks (details are not made public, of course...
A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me that a Google employee can potentially point to a number of email addresses and say: "These are th...
@ThomasPornin Not quite sure what was harder to decode, the Jupiter's rantings or the code itself :))
@Adnan His approach is all wrong as it wouldn't really stop Google from finding out who the messages were sent from, if he'd be using a public SMTP relay like that. There are (or should be) SMTP proxies out there that would strip the original headers and re-address messages. I don't know of any readily made app that'll do that without much work, though.
@Adnan There must be some, but it's not that difficult to write one's own (dunno, maybe 5 minutes with a good library?).
@TerryChia @AviD BTW update on the surface/surface pro video out interfaces. I was wrong before to say that they're both Mini-Displayport. the Surface pro is, but the Surface is some odd proprietary thing....
In a comment on this answer, AviD says:
"There are numerous security issues with wildcard SSL certs."
So, what are the problems? I understand that the same private key is being used in multiple contexts, but given that I could host all of my applications under the same host name I don't see thi...
It's important to understand what SSL does and does not do, especially since this is a very common source of misunderstanding.
It encrypts the channel
It applies integrity checking
It provides authentication
So, the quick answer should be: "yes, it is secure enough to transmit sensitive data...
A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me that a Google employee can potentially point to a number of email addresses and say: "These are th...
