Tag Info

Hot answers tagged

52

To understand this, we must understand how crawlers find the email. While steering away from the technicals, the basic idea is this (today's algorithms are, of course, smarter than that): Find @ in the page. Is there a dot within 255 characters after the @? Grab what's behind the @ until you reach a space or the beginning of the line. Grab the . and what's ...


21

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size. Further, if the images being transmitted have ...


13

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example: http://www.richkni.co.uk/php/crypta/trans0.php Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


9

Fundamentally you cannot secure your client. At best you can obscure and obfuscate in order to make it more difficult for an attacker to modify the client. You mention that it is not a security issue because the server is properly secured, but merely an annoyance. It may be more annoying to try to obscure your client than to let a few modified clients make ...


9

The article actually describes two constructions, the second one using the first one as a building tool. The first construction provides indistinguishability obfuscation while the second one is functional encryption. Indistinguishability obfuscation is a rather esoteric property, which is not what non-academic think about when they hear "obfuscation"; the ...


8

To my humble opinion, email obfuscation (of any sort) is one of the worse ideas ever invented. The foremost concern for any user interface, web based or any other, is convenience and safety of its users. Spam bots are not users, thus they are not worth any consideration or effort. The logic goes as following: E-mail obfuscation is a nuisance for ...


7

None. If they don't decompile your app, they will just put it through a proxy with it's own SSL certificate. Your client can't provide security for your backend.


7

I have never understood the paradigm since its conception. We are simply depriving spam battling software the necessary data. As mentioned before, adding "at" "dot" to the parser is trivial too. I would actually urge otherwise. Let the hell loose. Use your email and use any email for that matter. I even wrote a bot 10 years ago or so, where it produced ...


5

From a security, and even ideological, point of view; blobs are unacceptable. whatever people say, they are trying to dissuade you from the importance of this issue. the risks users of non-free software face, be it a firmware blob, driver blob, or Microsoft Windows, are vastly unmeasurable. and while it is safer using any Linux distro than Windows, it ...


5

It's harder to reverse-engineer complex code. You can introduce extra variables, pipe data through multiple classes, create classes which don't actually do anything, and generally muddy the waters. Measures such as this make it much more complex to reverse engineer your code, however it makes it much more difficult to engineer your code in the first place ...


3

Yes, it's possible although not quite the way some think. I've proposed a few ideas on Schneier's blog along these lines. There are a few ways of doing this: Your own microcode that starts with a processor that will not change. This can be accomplished using an open core, for instance, and freezing the internal design. Then you (and other users) do custom ...


3

When you don't want the user to have access to your code, you must not let them run it on their machine. It's that simple. As you already found out yourself, obfuscation doesn't work. So what option do you have? Run it on your own servers and offer it to the customer as a service, for example via SOAP. The drawbacks are that you need to administrate ...


3

There have been a few implementations of fully homomorphic encryption (2010). Fully homomorphic means it can perform addition AND multiplication (as opposed to partially homomorphic). The answer to your question though relies on what you consider "weak" and sufficient for security. Does the encryption have to stand up for 100 years, or is it OK if it's ...


2

"Is using 'dot' and 'at' in email addresses in public text still useful?" Good though responses have been, I rather doubt that it's ever been useful, and would expect email harvesters to have been scanning for that obfuscation even before people were naively using it (I certainly would have if I were in that game). Our own tests have also shown that it ...


2

what measures would you take to limit the risk of people tampering with your client software? There's a balance here that only you can measure. Assuming your protection doesn't bother valid users, then you only have to balance the value, to you, of protecting the software against the value to the attacker of breaking the protection. If you're talking ...


2

So, you're looking at how to handle basic Traffic Analysis? The basic countermeasures from Wikipedia (the above link) are exactly what I expected: "It is difficult to defeat traffic analysis without both encrypting messages and masking the channel. When no actual messages are being sent, the channel can be masked by sending dummy traffic, similar to the ...


2

In short: you can't. As long as someone has the local copy and the local copy is capable of retrieving this key, then someone could reverse engineer and get it. If someone had attempted to hide or obfuscate their code, then I would just step through the program in real-time or through IDA Pro. If at some point you store your key in a variable, then I'll ...


2

Note, there is no legitimate reason to hide the algorithm used if you use a suitably strong passphrase/key. If you are really concerned, you could open the encrypted file in a hex editor and change the fourth byte of the symmetrically encrypted ASCII armored file. E.g., the first four bytes of an symmetric encrypted file are: 8C 0D 04 09 with the ...


2

It looks like the passphrase which was used to encrypt the message with is encrypted with AES256. The algorithm used to encrypt the message is self is not known until the encrypted session key packet is decrypted. This is what pgpdump shows: Old: Symmetric-Key Encrypted Session Key Packet(tag 3)(13 bytes) New version(4) Sym alg - AES with 256-bit key(sym ...


2

It really depends on how sophisticated the crawler is. I doubt that the vast majority would go to the trouble of downloading word and excel documents, mainly due to the potential size. There are libraries available thought that make reading of doc, xls(x), pdf, etc. relatively easy. It is not out of the realm of possibility that some crawlers do download ...


1

With Snort you can compile your rules as "shared objects" that use C instead of the Snort language and can be obfuscated. See #2 here: http://blog.snort.org/2011/02/snort-shared-object-rules.html


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...


1

I recommend you to keep it simple. You could simply AES the fields you need to protect. Independently of the encryption method you use you must encrypt together some fields: Name + Surname Date of birth State + Street number + Street name *... Otherwise you could try statistical analysis against the data.


1

I understand your issues, but one of the fundamental maxims of cryptography is that you shouldn't reinvent the wheel and create your own encryption algorithm, primarily because it will be nowhere near as secure as an established one. Is this data going to be accessible over the Internet or transmitted over unencrypted channels? If the answer to either of ...


1

This is impossible. You could use a streaming server to send it over RTMP or even put some DRM on it to make it harder to play outside of a secured player, but the stream can always be ripped if it goes to a client's computer and DRM is just a small hurdle to be overcome by a determined attacker. You seem to be aware that it is impossible though, so the ...


1

Obfuscation is "required" when either of the three following situations applies: The application does something which is inherently weak such as embedding a secret value in the source code. The application designer wants to "feel safe", and is sufficiently incompetent at cryptography so that obfuscation provides that feeling (ignorance is bliss). The ...



Only top voted, non community-wiki answers of a minimum length are eligible