8,469 reputation
21354
bio website
location The Netherlands
age
visits member for 2 years, 11 months
seen 2 days ago

Student; manufactured 2 decades ago; interested in computer security and software engineering.


Apr
23
awarded  Excavator
Apr
23
comment How can browser select suggestions for my private searches?
@ewanm89 Yeah that's what I meant by "and the fact that you have JS disabled"; that also is a parameter that could be tracked.
Apr
23
comment How can browser select suggestions for my private searches?
@AJHenderson Usually disabling Javascript makes you pretty much indistinguishable besides your IP and user agent string. And the fact that you have JS disabled. My linux computer is pretty distinct on our family connection for 4 people.
Apr
23
comment How can browser select suggestions for my private searches?
"If you are truly clearing all the local records when you close the browser, are not logged in to any accounts and are connecting through a VPN, then there should be no way for a web server to recognize you between visits." Basically you are right, but practically it's a different story: panopticlick.eff.org
Apr
21
comment Can robots.txt for your face be made effective?
There is a difference between recognizing people that you saw earlier on the street and storing everyone's whereabouts in one big database, accessible to people that you cannot approve and you don't even know when anyone accesses the data.
Apr
18
comment Can Skype chat be protected from snooping? Are there safe alternatives?
From a person that I know who works with security a lot I've also heard this. He says that because Microsoft is much bigger, authorities already have contact with them, and it's much easier to submit such snooping requests for governments. Don't get me wrong, small companies are just as easy to threaten and get data from, but authorities don't give it much of a priority. It seems Skype is relatively hard to snoop though, changing encryption key every day... I don't know the details.
Apr
18
comment Automatic router admin password change
Actually @whitespy9's problem was mistyping the IP address. His DNS servers had nothing to do with it. It is interesting what happens with your router... Actually I'd think the ISP changes it or something.
Apr
18
reviewed Edit and Reopen Automatic router admin password change
Apr
18
revised Automatic router admin password change
deleted 106 characters in body; edited title
Apr
17
awarded  Nice Answer
Apr
16
comment If someone hacks my wi-fi connnection, what can they see and how?
Beyond breaking the connection or setting different DNS servers to be sent in DHCP, what more can an attacker do when he has the router password? Not many consumer routers will prevent ARP cache poisoning and the like, you can already do just about anything without router password.
Apr
16
comment The best ways to persist the license client information in the database
"The license client connects to the license server via HTTP to retrieve the license information" Why not https? You should use an encrypted connection, an own certificate (don't use the system store), and don't use the connection when another certificate is used. Having a daemon reply with "Yup you're valid" is the easiest attack vector for this kind of system. Your other problem it that it's Java, basically giving the sourcecode away, but I don't see any way to remediate that.
Apr
16
comment What is the distinguishing point between a script kiddie and a hacker?
I've heard some people describe themselves as currently being just scriptkiddies actually. They used some tools, but knew that they didn't understand it and knew the term for it. It's not merely a disparaging designation.
Apr
15
reviewed Leave Open Exploited by newbie3viLc063s
Apr
15
reviewed Leave Closed How non-executable are implemented?
Apr
15
comment What are the parameters to be logged in a web application?
I would not include the POST-data. This can include sensitive data, and logging is usually not encrypted while the normal processing of POST-data might encrypt it before saving it to the database. Also note that in some countries there are laws about what you are allowed to store and for which time period. Strictly seen, in the Netherlands you must tell the "College Bescherming Persoonsgegevens" (semi-govt organisation) about storing source IP addresses for anything but security purposes or longer than ~3-6 months.
Apr
15
answered Redirect attack
Apr
15
revised What are the ways to implement two factor authentication?
Replaced (imho unclear) 2fa tag with the already existing multi-factor tag
Apr
15
comment Exploited by newbie3viLc063s
@user2279808 He was able to compile some binary on your server? Interesting php settings you have. What user does it even run as... Anyway, yeah perhaps I would actually just reinstall the whole thing then and check all files manually before putting them back.
Apr
14
comment Exploited by newbie3viLc063s
@user2279808 Technically no, any files could be in there. Perhaps if you verify the files' age to be well before any signs of the breach. I would personally not reinstall the entire server, but from a security standpoint, it is the right thing to be advised.