Light

Episode #988 Quiz

National Public Data
Date: 2024-08-20 | Length: 2 hrs | Episode page at twit.tv

About this episode

GRC’s revoked certificate test showed why OCSP stapling and Must Staple are brittle: when stapling expires, Chrome, Safari, and Edge ignore revocation, but Firefox queries OCSP directly and blocks the site. Microsoft’s Patch Tuesday fixed 90 vulnerabilities, including six actively exploited zero-days in IE mode, Mark of the Web, Project, and Secure Boot.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In Steve Gibson's explanation of why OCSP Must Staple is attractive yet problematic, what specific failure mode did he say would cause a widespread outage if the industry mandated stapling?

Question 1

In Steve Gibson's explanation of why OCSP Must Staple is attractive yet problematic, what specific failure mode did he say would cause a widespread outage if the industry mandated stapling?

A one-day outage of a CA's OCSP service A one-day outage of a DNS resolver used by browsers A one-week outage of a certificate signing service A one-day outage of a browser vendor's CRL distribution service

Question 2: What exact Firefox setting did Steve identify as the reason Firefox alone continued to block his deliberately revoked GRC site?

Question 2

What exact Firefox setting did Steve identify as the reason Firefox alone continued to block his deliberately revoked GRC site?

Require certificate transparency logs for all HTTPS connections Reject all certificates older than 397 days without exception Disable all cached certificate decisions when a site is reloaded Query OCSP responder servers to confirm the current validity of certificates

Question 3: According to Steve's summary of the June discovery and Troy Hunt's analysis, what did the NPD data show about people who had used data opt-out services?

Question 3

According to Steve's summary of the June discovery and Troy Hunt's analysis, what did the NPD data show about people who had used data opt-out services?

They were included, but only after their addresses were redacted They appeared only once and without Social Security Numbers They were present only in the later partial archive with email addresses They were conspicuously absent from the dataset

Question 4: How did Troy Hunt reconcile the claim of 2.9 billion records with the actual number of unique Social Security Numbers in the sample he examined?

Question 4

How did Troy Hunt reconcile the claim of 2.9 billion records with the actual number of unique Social Security Numbers in the sample he examined?

He estimated it would represent about 450 million people He estimated it would represent about 899 million people He estimated it would represent about 31 million people He estimated it would represent about 2.7 billion people

Question 5: Which file did Troy identify as especially suggestive of overlap with an earlier, separate breach because it had the same size as a prior criminal database dump he had already archived?

Question 5

Which file did Troy identify as especially suggestive of overlap with an earlier, separate breach because it had the same size as a prior criminal database dump he had already archived?

Accuitty_10_1_2022.zip uk.txt criminal_export.csv.zip NationalPublicData.csv.zip

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.