328 reputation
111
bio website
location
age
visits member for 2 years, 6 months
seen Dec 19 at 21:56

May
16
comment Why are certificates limited in time?
And even then, CRLs aren't fully reliable.
Mar
24
comment How can I prevent that my users get a certificate issued for my domain on my behalf?
Ah, this story brings back memories. CA: We need to do a phone verification. Me: Hi, I'm Brian. CA: Can you prove it? Me: Sure, here's my boss. Boss: I'm his boss. He's Brian. CA: Great, thanks! You're all set.
Feb
10
comment If I include a Forgot Password service, then what's the point of using a password?
Needing to trust both you and my chosen email server is not very different from needing to trust both you and my chosen openID provider...and in many cases a user's openID provider and email server are identical.
Sep
23
comment Could a user never store a password if a username/email hash was used instead?
A random javascript PBKDF2 implementation: anandam.name/pbkdf2
Sep
23
comment Could a user never store a password if a username/email hash was used instead?
@JohnDeters: As my proposal is about a browser extension, the use of PBKDF2 is feasible (and it's perfectly possible to implement PBKDF2 in javascript). And there's nothing stopping the extension's generated secret from being very complex. So, reversing the hash from via brute force would impossible (since the user's original password is mostly random, from the hacker's perspective, and thus there is no way to differentiate the password from other passwords which yield the same hash). This assumes the use of a unique private key, as mentioned in downside #4.
Sep
23
comment Could a user never store a password if a username/email hash was used instead?
@bwheeler96: Running MITB is much more difficult. For example, running MiTM is often as simple as running a wifi hotspot and seeing who uses it (and hoping they don't use SSL). MITB attacks require tricking the user into downloading a vulnerable browser or taking advantage of an unpatched vulnerability.
Sep
20
comment Hide a machine on LAN
Is your intention to have machines connected to your wireless access point be segregated from your network but still have internet access?
Sep
20
comment Ensure web service only accessed by authorized applications
The downside of using a tried and tested algorithm to protect something that is inherently un-protectable is that tried and tested algorithms are more likely to have existing reversal algorithms. In traditional security, protecting the algorithm is unimportant; the goal is to use an algorithm that is safe (unless the key is known), even if the algorithm is public. If no such algorithm exists (in this case, because the key must be held on the client-side), security through obscurity is less unreasonable; there are no good choices.
Oct
30
comment How can I encrypt a file with .NET and have the same file size of the original file?
Just to emphasize Thomas saying you need integrity: If I am a man-in-the-middle and know you probably sent the message !JUNK!Please send $500 to Joe Smith!JUNK!, I may be able to change it to !JUNK!Please send $600 to Joe Smith!JUNK! Encryption w/o integrity prevents someone from knowing what was said, but does not protect you from someone changing what was said. Some of your message is probably predictable, so this is pretty dangerous.
Oct
22
comment 172.16.33.197, 127.0.0.1 IP addresses in visitor logs
Just because they are user supplies does not mean they are supplied by your user. Many proxies happily provide that header. The HTTP_X_FORWARDED_FOR header can be safely used for a blacklist in conjunction with the REMOTE_ADDR.
Oct
18
comment What are methods for preventing browser hooking / drive-by downloads?
A sandboxing tool is a possible alternative to a VM, though it requires more user effort. Note that installing integration tools into your VM often opens up your host machine to infection, especially in the case of clipboard and drive sharing. Such holes tend to show up as virus-friendly network shares.
Oct
2
comment Is it safe to store the password hash in a cookie and use it for “remember-me” login?
Note: Make sure your cookies are "secure" (mitigates MITM attacks) and "httponly" (mitigates XSS attacks).
Oct
2
comment Store a password to avoid user interaction
I suggest that you create a new email account solely for reporting use. I leave deciding where to store the account credentials to people answering your actual question.
Oct
2
comment Store a password to avoid user interaction
@StrangeWill: OAuth does prevent hijacking the account. OAuth lets you use the account, but not change the account password. You can decide what permissions an oauth token gives. A user's gmail token won't give access to that user's webmaster account, but a user's Google password will. If necessary, a user can revoke the OAuth tokens. Note that this does nothing to answer your original question of how to store a token securely; it only tells you which token to store.
Sep
25
comment What is the impetus for major sites being HTTPS-exclusive now?
@casperOne: The whitepaper is at dev.chromium.org/spdy/spdy-whitepaper
Sep
21
comment Steganography to hide text within text
You may find "chaffing and winnowing" to be of interest, though it isn't precisely steganography.
Sep
20
comment Can I check if a work colleague logged into my user account on a shared computer?
If you're on a domain, any domain administrators can probably login to your machine using their own username/password.
Sep
6
comment Has any virus attempted to compromise the anti-virus database?
@TerryChia: Once a virus is identified, a good AV will have sufficient information to be able to remove it, or to help the user find a removal tool. Of course, this excludes viruses which support patching and code downloads, which seems to be in fashion lately. Such viruses may have downloaded custom trojans (or mis-configured the user's system in an unpredictable fashion).
Sep
6
comment Has any virus attempted to compromise the anti-virus database?
One solution is to boot off a clean disk and scan your machine from there. That's probably your best bet for detecting rootkits.
Sep
6
comment Why most people use 256 bit encryption instead of 128 bit?
I might be remembering this incorrectly...If you are encrypting a lot of data, you may end up with duplicate subkeys (subkey is probably the wrong term) if there is enough data. This is functionally equivalent to reusing a one-pad cypher. I believe key size, block size, and cypher mode were what determined how much data was too much data.