meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 11 months |
| seen | Jan 8 at 21:06 | |
| stats | profile views | 3 |
|
Oct 31 |
awarded | Citizen Patrol |
|
Oct 30 |
comment |
How can I encrypt a file with .NET and have the same file size of the original file? Just to emphasize Thomas saying you need integrity: If I am a man-in-the-middle and know you probably sent the message !JUNK!Please send $500 to Joe Smith!JUNK!, I may be able to change it to !JUNK!Please send $600 to Joe Smith!JUNK! Encryption w/o integrity prevents someone from knowing what was said, but does not protect you from someone changing what was said. Some of your message is probably predictable, so this is pretty dangerous. |
|
Oct 22 |
comment |
172.16.33.197, 127.0.0.1 IP addresses in visitor logs Just because they are user supplies does not mean they are supplied by your user. Many proxies happily provide that header. The HTTP_X_FORWARDED_FOR header can be safely used for a blacklist in conjunction with the REMOTE_ADDR. |
|
Oct 18 |
comment |
What are methods for preventing browser hooking / drive-by downloads? A sandboxing tool is a possible alternative to a VM, though it requires more user effort. Note that installing integration tools into your VM often opens up your host machine to infection, especially in the case of clipboard and drive sharing. Such holes tend to show up as virus-friendly network shares. |
|
Oct 2 |
comment |
Is it safe to store the password hash in a cookie and use it for “remember-me” login? Note: Make sure your cookies are "secure" (mitigates MITM attacks) and "httponly" (mitigates XSS attacks). |
|
Oct 2 |
comment |
Store a password to avoid user interaction I suggest that you create a new email account solely for reporting use. I leave deciding where to store the account credentials to people answering your actual question. |
|
Oct 2 |
awarded | Commentator |
|
Oct 2 |
comment |
Store a password to avoid user interaction @StrangeWill: OAuth does prevent hijacking the account. OAuth lets you use the account, but not change the account password. You can decide what permissions an oauth token gives. A user's gmail token won't give access to that user's webmaster account, but a user's Google password will. If necessary, a user can revoke the OAuth tokens. Note that this does nothing to answer your original question of how to store a token securely; it only tells you which token to store. |
|
Sep 25 |
comment |
What is the impetus for major sites being HTTPS-exclusive now? @casperOne: The whitepaper is at dev.chromium.org/spdy/spdy-whitepaper |
|
Sep 21 |
comment |
Steganography to hide text within text You may find "chaffing and winnowing" to be of interest, though it isn't precisely steganography. |
|
Sep 20 |
comment |
Can I check if a work colleague logged into my user account on a shared computer? If you're on a domain, any domain administrators can probably login to your machine using their own username/password. |
|
Sep 6 |
comment |
Has any virus attempted to compromise the anti-virus database? @TerryChia: Once a virus is identified, a good AV will have sufficient information to be able to remove it, or to help the user find a removal tool. Of course, this excludes viruses which support patching and code downloads, which seems to be in fashion lately. Such viruses may have downloaded custom trojans (or mis-configured the user's system in an unpredictable fashion). |
|
Sep 6 |
comment |
Has any virus attempted to compromise the anti-virus database? One solution is to boot off a clean disk and scan your machine from there. That's probably your best bet for detecting rootkits. |
|
Sep 6 |
comment |
Why most people use 256 bit encryption instead of 128 bit? I might be remembering this incorrectly...If you are encrypting a lot of data, you may end up with duplicate subkeys (subkey is probably the wrong term) if there is enough data. This is functionally equivalent to reusing a one-pad cypher. I believe key size, block size, and cypher mode were what determined how much data was too much data. |
|
Aug 31 |
comment |
How can one defend against DoS attacks at the physical layer? @Iszi: In the US, what they were doing would constitute harmful interference. There really isn't that much you can do about interference. Consider: People already talk about the difficulties of countering accidental interference, yet it are not fully successfully. Deliberate interference is always going to be at least as difficult as countering accidental interference. |
|
Aug 31 |
comment |
How can one defend against DoS attacks at the physical layer? Sue them. Make your building into a Faraday cage. Use Wired connections. |
|
Aug 14 |
awarded | Caucus |
|
Jul 20 |
awarded | Mortarboard |
|
Jul 20 |
awarded | Nice Answer |
|
Jul 20 |
awarded | Teacher |
