<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>netsekure rng &#187; Nasko</title>
	<atom:link href="http://netsekure.org/author/nasko/feed/" rel="self" type="application/rss+xml" />
	<link>http://netsekure.org</link>
	<description>random noise generator</description>
	<lastBuildDate>Fri, 04 Nov 2011 19:48:48 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Pass-The-Hash vs cookie stealing</title>
		<link>http://netsekure.org/2011/11/pass-the-hash-vs-cookie-stealing/</link>
		<comments>http://netsekure.org/2011/11/pass-the-hash-vs-cookie-stealing/#comments</comments>
		<pubDate>Fri, 04 Nov 2011 19:48:48 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[Cookies]]></category>
		<category><![CDATA[HTTP Authentication]]></category>
		<category><![CDATA[pass-the-hash]]></category>
		<category><![CDATA[Windows Authentication]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=340</guid>
		<description><![CDATA[I saw a few talks at the BlueHat conference at Microsoft and the funniest of all was Joe McCray&#8217;s (@j0emccray) &#8220;You Spent All That Money And You Still Got Owned????&#8221;. At some point, he touched on Pass-The-Hash attacks and asked why those can&#8217;t be prevented. That struck me as an interesting question and an analogy [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2011/11/pass-the-hash-vs-cookie-stealing/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How to approach fixing the TLS trust model</title>
		<link>http://netsekure.org/2011/08/how-to-approach-fixing-the-tls-trust-model/</link>
		<comments>http://netsekure.org/2011/08/how-to-approach-fixing-the-tls-trust-model/#comments</comments>
		<pubDate>Tue, 30 Aug 2011 06:49:30 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Convergence]]></category>
		<category><![CDATA[DNSSEC]]></category>
		<category><![CDATA[https]]></category>
		<category><![CDATA[OCSP]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[trust model]]></category>
		<category><![CDATA[trusted CA]]></category>
		<category><![CDATA[trusted root certificates]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=334</guid>
		<description><![CDATA[TLS is an exciting protocol and its wide deployment makes it even more interesting to work on. It has been said many times that the success of online commerce is due to the success of SSL/TLS and the fact that people felt safe in submitting their credit card information over the Internet. These days a [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2011/08/how-to-approach-fixing-the-tls-trust-model/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>TLS Client Authentication and Trusted Issuers List</title>
		<link>http://netsekure.org/2011/04/tls-client-authentication-and-trusted-issuers-list/</link>
		<comments>http://netsekure.org/2011/04/tls-client-authentication-and-trusted-issuers-list/#comments</comments>
		<pubDate>Fri, 29 Apr 2011 21:09:19 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Dossiers]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[certificate_authorities]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[trusted issuers list]]></category>
		<category><![CDATA[trusted root certificates]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=289</guid>
		<description><![CDATA[One of the common questions I&#8217;ve seen asked lately is related to TLS client authentication, which likely means more people are interested in stronger client authentication. The problem people are hitting is described in KB 933430, where the message the server sends to the client to request client authentication is being trimmed. Let&#8217;s look at why [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2011/04/tls-client-authentication-and-trusted-issuers-list/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Automatic CA root certificate updates on Windows</title>
		<link>http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/</link>
		<comments>http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/#comments</comments>
		<pubDate>Sat, 16 Apr 2011 05:58:18 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Chrome]]></category>
		<category><![CDATA[IE]]></category>
		<category><![CDATA[KB 931125]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[trusted CA]]></category>
		<category><![CDATA[trusted root certificates]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=301</guid>
		<description><![CDATA[I was recently listening to Chris Palmer talking about SSL on the PaulDotCom podcast and one thing caught my attention – the discussion on IE behavior with trusted roots certificates. It was discussed that IE is violating the “No-Write-Up” policy of the integrity level (IL) mechanism in Windows. While the end effect looks like it, [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2011/04/automatic-ca-root-certificate-updates-on-windows/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Fraudulent SSL certificates</title>
		<link>http://netsekure.org/2011/03/fraudulent-ssl-certificates/</link>
		<comments>http://netsekure.org/2011/03/fraudulent-ssl-certificates/#comments</comments>
		<pubDate>Wed, 23 Mar 2011 18:40:18 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[breach]]></category>
		<category><![CDATA[CA]]></category>
		<category><![CDATA[compromise]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[trusted CA]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=294</guid>
		<description><![CDATA[As many people are reporting today, there have been a few SSL certificates issued to a fraudulent party. The Comodo CA had an RA account compromised and used to issue certificates for some of the top web sites on the net. Their advisory is http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html. All major browsers are updating to blacklist those certificates and [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2011/03/fraudulent-ssl-certificates/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Windows SSL/TLS update for secure renegotiation</title>
		<link>http://netsekure.org/2010/08/windows-ssltls-update-for-secure-renegotiation/</link>
		<comments>http://netsekure.org/2010/08/windows-ssltls-update-for-secure-renegotiation/#comments</comments>
		<pubDate>Thu, 26 Aug 2010 05:16:36 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[KB 980436]]></category>
		<category><![CDATA[MS10-049]]></category>
		<category><![CDATA[renegotiation]]></category>
		<category><![CDATA[RFC 5746]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[TLS1.1]]></category>
		<category><![CDATA[TLS1.2]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=283</guid>
		<description><![CDATA[Couple of weeks ago Microsoft released an update to the SSL/TLS stack to implement secure renegotiation as described in RFC 5746. The Microsoft KB article describes the three settings controlling the behavior of the patch, but a bit more detail can be useful. A bit of background first. TLS extensions are a method of extending [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2010/08/windows-ssltls-update-for-secure-renegotiation/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>PhoneFactor WordPress plugin</title>
		<link>http://netsekure.org/2010/06/phonefactor-wordpress-plugin/</link>
		<comments>http://netsekure.org/2010/06/phonefactor-wordpress-plugin/#comments</comments>
		<pubDate>Wed, 16 Jun 2010 15:11:25 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Software]]></category>
		<category><![CDATA[PhoneFactor]]></category>
		<category><![CDATA[plugin]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=278</guid>
		<description><![CDATA[I have recently stumbled upon the plugin PhoneFactor has for WordPress and decided to give it a shot, knowing the idea behing the PhoneFactor authentication model. The install was smooth, since WordPress does a good job on integrating installing plugins into the admin panel. There were a few issues that I hit once it was [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2010/06/phonefactor-wordpress-plugin/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Privilege separation in WordPress</title>
		<link>http://netsekure.org/2010/05/privilege-separation-in-wordpress/</link>
		<comments>http://netsekure.org/2010/05/privilege-separation-in-wordpress/#comments</comments>
		<pubDate>Thu, 27 May 2010 21:15:42 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[database permissions]]></category>
		<category><![CDATA[low privilege]]></category>
		<category><![CDATA[privilege separation]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=193</guid>
		<description><![CDATA[A recent retweet by Jeremiah Grossman got me thinking. Why doesn&#8217;t WordPress implement privilege separation in their blog engine? After all it is fairly simple and can be implemented in a few lines of code. I don&#8217;t know the reason to be honest, as this is one of the basic rules of security. Few months [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2010/05/privilege-separation-in-wordpress/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Results after 30 days of (almost) no trusted CAs</title>
		<link>http://netsekure.org/2010/05/results-after-30-days-of-almost-no-trusted-cas/</link>
		<comments>http://netsekure.org/2010/05/results-after-30-days-of-almost-no-trusted-cas/#comments</comments>
		<pubDate>Fri, 07 May 2010 17:25:17 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Projects]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Chrome]]></category>
		<category><![CDATA[Firefox]]></category>
		<category><![CDATA[IE]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[TLS1.1]]></category>
		<category><![CDATA[TLS1.2]]></category>
		<category><![CDATA[trusted CA]]></category>
		<category><![CDATA[trusted root certificates]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=261</guid>
		<description><![CDATA[Today marks the 30th day since I removed all the root certificates for trusted certificate authorities. It was an interesting one month and I&#8217;ve learned a bunch. The main takeaway from this experiment is that I don&#8217;t need 3 digit number of trusted CAs in my browser. Again, this is person specific and US centric, [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2010/05/results-after-30-days-of-almost-no-trusted-cas/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>30 days with (almost) no trusted CAs</title>
		<link>http://netsekure.org/2010/04/30-days-with-almost-no-trusted-cas/</link>
		<comments>http://netsekure.org/2010/04/30-days-with-almost-no-trusted-cas/#comments</comments>
		<pubDate>Thu, 15 Apr 2010 07:05:11 +0000</pubDate>
		<dc:creator>Nasko</dc:creator>
				<category><![CDATA[Projects]]></category>
		<category><![CDATA[Firefox]]></category>
		<category><![CDATA[IE]]></category>
		<category><![CDATA[SSL]]></category>
		<category><![CDATA[TLS]]></category>
		<category><![CDATA[trusted CA]]></category>
		<category><![CDATA[trusted root certificates]]></category>

		<guid isPermaLink="false">http://netsekure.org/?p=256</guid>
		<description><![CDATA[I&#8217;ve decided to embark on a small project to determine what is the smallest set of trusted root certificates I need in my day-to-day life. I have disabled all trusted CAs in both IE and Firefox and will enable the needed root certificates as I go. So far I&#8217;ve spent a week of this and [...]]]></description>
		<wfw:commentRss>http://netsekure.org/2010/04/30-days-with-almost-no-trusted-cas/feed/</wfw:commentRss>
		<slash:comments>14</slash:comments>
		</item>
	</channel>
</rss>

