Collaborate Disseminate
I have a stateless machine that is PXE booting from some host, and I’m curious if there is some clever way to achieve host authentication by only using the TMP (No UEFI Secure Boot).
For obvious reasons, I cannot really use code downloaded… Continue reading Using a TPM for host authentication during PXE boot
Lets say Bob wishes to communicate with Alice.
Alice’s public key is useless to Bob unless he can prove that the public key came from Alice. To do this, Bob and Alice can establish a secure channel to exchange Alice’s the public key, but t… Continue reading Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
A valid certificate cannot guarantee that I’m not being MITM’d right now, as either the private key or CA may have been compromised. For this reason, I have to contact a CA through CRL/OCSP to check if it’s been revoked. Best case, I can h… Continue reading What’s the point of certificates in SSL/TLS?
Say you’re a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply don’t disclose the bug a… Continue reading Contacting customers of vulnerable software, is it wrong?