Collaborate Disseminate
My answer here, resulted in this comment:
This could be subject to a TOCTOU1 attack and needs to be developed to be correct.
The answer is in Rust, but here’s some equivalent bash:
p=/home/roger/foo/bar/baz.txt
d=$(dir… Continue reading How is mkdir subject to a TOCTOU attack?
Bitwarden (as an example) allows you to store your TOTP tokens in it. That is: you can use the mobile app to scan the QR code that (e.g.) Amazon AWS gives you, and then it’ll generate TOTP codes.
So far, so exactly the same … Continue reading Is it a good idea to store TOTP tokens in a (synchronised) password safe?
I’ve got the Microsoft Authenticator app installed on my Google Pixel phone. When I sign into a Microsoft site, the site shows me a two-digit number (e.g. 34) and the app on my phone asks me to choose the matching number from… Continue reading Why does Microsoft Authenticator app ask me to choose a number?
I’ve got an Android tablet (Samsung Tab S2) and a Bluetooth keyboard (Celicious Tri BK01). I occasionally use the keyboard to enter my password.
Is there any way, in Android, to find out whether the Bluetooth traffic is encrypted? How can… Continue reading Can I find out what encryption is used by my Android Bluetooth keyboard?
If I’m running a VM on Amazon EC2 or Microsoft Azure, and they’ve patched the underlying hypervisor, do I need to upgrade my Linux kernel to protect against Meltdown or Spectre?
Assume that I’m not running any untrusted soft… Continue reading Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest?
Context: I’ve got some C++ code that uses curl with GnuTLS that’s failing to connect to https://googleapis.com since Ubuntu updated the ca-certificates package. That, as far as I can tell, corresponds to Debian bug #858064.
… Continue reading Server certificate terminates in removed CA certificate, still works?
In order to mitigate the “Poodle” vulnerability, I’d like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I’ve done this?
Continue reading How do I use "openssl s_client" to test for (absence of) SSLv3 support?
In order to mitigate the “Poodle” vulnerability, I’d like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I’ve done this?
Continue reading How do I use "openssl s_client" to test for (absence of) SSLv3 support?