Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

According to the episode, what is the primary security benefit introduced by Chrome 145's Device Bound Session Credentials feature?

Storing session cookies in the browser's encrypted storage container to prevent theft. Binding session cookies to the specific device that received them to prevent reuse elsewhere. Encrypting session cookies on the server to prevent interception. Requiring multi-factor authentication for every session cookie use.

Question 2

What new attestation requirement did the CA/Browser Forum add for issuing code signing certificates starting in 2026, as described by Steve Gibson?

Applicants must register their code signing keys with a global blockchain ledger. Applicants must provide a notarized self-declaration of business legitimacy. Code signing certificates require face-to-face biometric verification of the applicant. A licensed attorney or CPA must provide an attestation letter confirming the applicant's organizational identity.

Question 3

What operational issue did AI.com experience during its Super Bowl advertisement, according to the episode?

The website suffered a database corruption that delayed response times. A DNS misconfiguration caused the domain to be unreachable during the event. The website's backend server was unable to scale sufficiently to handle the sudden traffic spike. Cloudflare's CDN was overwhelmed by traffic and failed to deliver content.

Question 4

Why did the first known malicious Microsoft Outlook add-in succeed in stealing user credentials, as explained in the episode?

Because Microsoft did not digitally sign any Office add-ins before publishing. Because the attacking party claimed an abandoned developer's domain URL hosted by Vercel and deployed phishing content. Because the add-in's manifest allowed automatic updates without review by Microsoft. Because users downloaded the add-in from unverified third-party websites outside Microsoft's Store.

Question 5

What was Steve Gibson's perspective on shortening TLS/SSL certificate lifetimes to approximately six months, as mandated starting February 2026?

He considered it an inconvenient change that increases operational burden without clear benefits. He was bitterly disappointed; saw it as an unnecessary hassle that complicates renewal and validation processes. He encouraged all users to switch immediately to paid certificates from DigiCert for better security. He viewed it as a necessary improvement with no downsides.

Cancel

Episode #1065 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5