croikle

> Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure.

https://www.openssl.org/docs/apps/s_client.html

https://www.mail-archive.com/[email protected]/msg71...

Comment · 13 years ago

Yeah, I'm not sure. The linked diagram [1] shows them influencing routing, rather than some timing issue.

[1] https://www.documentcloud.org/documents/785152-166819124-mit...

Comment · 13 years ago

Bufferbloat on the upstream pipe, if somebody is using your shared connection.

Comment · 13 years ago

AMA: http://www.reddit.com/r/MMA/comments/13govr/hi_rmma_im_one_o...

You can find plenty of wikidrama at https://en.wikipedia.org/wiki/User_talk:Agent00f and https://en.wikipedia.org/wiki/Wikipedia:Requests_for_comment...

Comment · 13 years ago

One license offered for Phil Rogaway's OCB block-cipher mode explicitly prohibits military use. (although, as I read it, the military could use still open source implementations under the other license)

http://www.cs.ucdavis.edu/~rogaway/ocb/license.htm

Comment · 13 years ago

Even disregarding Apple's control over the software, the system depends on Apple as a trusted key distributor. This is the vulnerability which the article is concerned with, as far as I can tell.

Comment · 13 years ago

It's a cute idea, but you have 1/r^4 intensity scaling, which is prohibitive even at lunar distance. The lunar ranging experiments receive "one photon every few seconds" [1]. You could probably do better with bigger equipment, higher power, and perhaps an orbiting base station to skip the atmosphere, but the numbers are going to win before too long.

An active repeater would give you 1/r^2, though. For example, you could ping Voyager I for a 36-hour delay. However, that's likely not feasible at light-year distances, let alone the problem of getting the devices there. :)

[1] http://www.jpl.nasa.gov/news/news.php?feature=605

Comment · 13 years ago

> Apple claims that even with access to the device, a nine digit passcode would take 2.5 years to brute force.

That's 2.5 iPhone-years of computation, though. A speedy desktop could be 10 times as fast, and that's before we get to GPUs or multiple machines.

Comment · 13 years ago

Chrome's pinning is a definite upgrade, but it's more vulnerable than some people make it seem. In practice, a pin consists of a list of CA certificates which are allowed to sign for the given domain (the list is in [1]). This list can be surprisingly long: for example, the list for twitter.com contains 22 keys from 3 different CAs.

This means that, e.g., if you are "good friends" with Verisign, you can get them to issue a certificate for any Google property, and Chrome will happily accept it.

[1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...