Reputation
10,488
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
2 17 61
Newest
 Announcer
Impact
~613k people reached

Jul
10
comment Is there a security reason for a site to limit the number of times a user can change their password?
@TobiasKienzler What does that have to do with this?
Jul
10
comment Is there a security reason for a site to limit the number of times a user can change their password?
Well I guess there is no point in commenting this here, but limits like these are just so annoying. In general I'm very much for burst rates: let the user change the password three times in 72 hours. You can't get back to the original any faster than you can with 1/24h, but at least you can correct something if you've made a mistake (capslock on or whatever)...
Jul
10
comment Is there a tool to verify browser TLS/SSL configuration
@dfc From the speed and number of requests the browser makes, I'd guess that the info is what the browser sends upon connecting. The browser tells the server "hey I wanna setup SSL/TLS and support the following: x, y, z. What's it gonna be?" This website then displays back to you what the browser offered to use. So it's not "only those that the server probed for" but the other way around. See also the second sentence of the "high level description" in this post of mine: security.stackexchange.com/a/20833/10863
Jul
4
comment Security of remailers
It sounds like you're asking this to confirm something else that you want to know. What is the purpose behind your question? Edit: As a basic answer: no, not when the source is actually an intermediary who is not disclosing the real source.
Jul
4
revised Reversing Password Hashes
added 308 characters in body
Jul
4
answered Reversing Password Hashes
Jul
3
comment Besides IP addresses, how else could one be identified?
Someone's face? Really, you gotta be more clear in what situation you're imagining. I'd assume something online since you're talking about an IP address, but even then you might be talking about website visitors, someone who stole your computer, or an attack on your website with a DNS amplification attack, to name just a few.
Jul
2
comment What is the difference between https://google.com and https://encrypted.google.com?
@KonradRudolph As an example, yesterday I looked at the referring sites from a website I maintain and found some things I hadn't expected people to search for. Knowing those (one example search was "harbor roermond", in Dutch) we can optimize the website so that we can be found more easily; we weren't the top hit while some above us were useless linkspam. I myself never did it, but even if this was only to make money, then even in that case the user might profit from it. But this could become a very long discussion. Feel free to ping me in the DMZ or another room if you want to discuss it ;)
Jul
2
comment What is the difference between https://google.com and https://encrypted.google.com?
@KonradRudolph The http referer header is one of the most useful things for webmasters. If you come from a https website it's not sent anyway, so no data is leaked. You may consider enabling it again for our sake.
Jul
2
comment How does YouTube prevent automatic piracy?
It doesn't do it very effectively if anything. See the youtube-dl tool for Linux.
Jun
28
revised House owner can see who's connected to WiFi; what more can he see?
Clarified title, added tags
Jun
25
awarded  Yearling
Jun
23
comment How long is a 2048-bit RSA key?
I meant, explain in your post like others do. The answer should contain the info, not the comments on an answer ;)
Jun
23
comment How long is a 2048-bit RSA key?
Correct answer it seems, but please explain why this formula is correct.
Jun
19
comment How to make / dump contents of memory for forensics analysis?
Isn't the memory stored in hiberfil.sys when you hibernate? You could read that file with a Linux live boot.
Jun
19
awarded  Announcer
Jun
17
comment Backdoors after SQL injection?
Practical example: Some university here left port 80 open for users so that they could host servers there. Someone had an unprotected wamp installation (windows, apache, mysql, php, phpmyadmin), and I was able to compromise his laptop entirely (admin account) by using a simple INTO OUTFILE statement and then calling the php script remotely. LIke Adnan said, without analysis you should assume the worst.
Jun
14
revised Can your Windows or Linux username be exposed to websites?
Added `input type=file` part
Jun
14
comment Can your Windows or Linux username be exposed to websites?
@Strapakowsky Nope, the path is not exposed to Javascript. Maybe some obscure browser, but recent versions of Chrome, Firefox and IE9 only expose the filename, never the path. Or at least, I don't know of any hacks that make it possible.
Jun
13
awarded  Announcer