Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

According to the episode, what is the primary security benefit introduced by Chrome 145's Device Bound Session Credentials feature?

Binding session cookies to the specific device that received them to prevent reuse elsewhere. Storing session cookies in the browser's encrypted storage container to prevent theft. Encrypting session cookies on the server to prevent interception. Requiring multi-factor authentication for every session cookie use.

Question 2

What new attestation requirement did the CA/Browser Forum add for issuing code signing certificates starting in 2026, as described by Steve Gibson?

Code signing certificates require face-to-face biometric verification of the applicant. Applicants must provide a notarized self-declaration of business legitimacy. Applicants must register their code signing keys with a global blockchain ledger. A licensed attorney or CPA must provide an attestation letter confirming the applicant's organizational identity.

Question 3

What operational issue did AI.com experience during its Super Bowl advertisement, according to the episode?

A DNS misconfiguration caused the domain to be unreachable during the event. The website suffered a database corruption that delayed response times. Cloudflare's CDN was overwhelmed by traffic and failed to deliver content. The website's backend server was unable to scale sufficiently to handle the sudden traffic spike.

Question 4

Why did the first known malicious Microsoft Outlook add-in succeed in stealing user credentials, as explained in the episode?

Because the attacking party claimed an abandoned developer's domain URL hosted by Vercel and deployed phishing content. Because Microsoft did not digitally sign any Office add-ins before publishing. Because users downloaded the add-in from unverified third-party websites outside Microsoft's Store. Because the add-in's manifest allowed automatic updates without review by Microsoft.

Question 5

What was Steve Gibson's perspective on shortening TLS/SSL certificate lifetimes to approximately six months, as mandated starting February 2026?

He encouraged all users to switch immediately to paid certificates from DigiCert for better security. He considered it an inconvenient change that increases operational burden without clear benefits. He viewed it as a necessary improvement with no downsides. He was bitterly disappointed; saw it as an unnecessary hassle that complicates renewal and validation processes.

Cancel

Episode #1065 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5