Reputation
10,558
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
2 17 61
Newest
 Announcer
Impact
~616k people reached

15h
comment How can I detect screenshots?
Voted to move this to StackOverflow because it seems like a programming question ("How do I do X") and although the topic has security-related implications, it's not a question about IT security. If others agree (and vote the same) it will be moved automatically, you do not need to create a new question there. It's a good question, though.
Feb
7
comment While working from home, is it a bad idea to give the company you work for your IP address?
@ChrisCirefice See security.stackexchange.com/q/35160/10863 for the generic question. The answers are a bit specific, but the question is there.
Feb
7
comment how to AES cipher?
That's oddly specific, as if you're trying to decrypt something you intercepted from someone...
Feb
4
comment How trustworthy is Firefox?
Just to be clear, you are talking about the Sync feature of Firefox? Or merely the offline password storage when using a master password?
Jan
9
comment How secure is WD MyPassport lock
Regarding "When the user changes his password, K is decrypted with the old password and re-encrypted with the new." (and the rest of that paragraph): is there actually a name for this scheme? I refer to it now and then but end up explaining it over and over.
Nov
29
comment Spoofing IP address as being local over the Internet
But ISPs are, for example.
Nov
29
comment Spoofing IP address as being local over the Internet
@ash More or less, but there is a big difference between, say, "basically it's never done" and "near universal in the western world". I don't know which of the two it is and it's pretty easy to distinguish between the former and the latter, even if all you have is personal accounts. That's what I'm after. And you could say the same for a thousand other questions, like "why do some websites only allow short passwords" (or something like that is one of the more popular questions on this site). I could perhaps rephrase my question to "why doesn't everyone" to make it more objective...
Nov
29
comment Spoofing IP address as being local over the Internet
Well they do the same with filtering port 25 or something, it's just checking a few bytes with hardly any conditionals or other complexity. But anyway, your point is that they don't for performance reasons, thus RFC1918 @IPs will typically arrive just fine if it's not filtered by the destination network or host?
Nov
29
comment Spoofing IP address as being local over the Internet
Well the edge routers at my ISP certainly have an inside and outside, but more importantly, no ISP routers nor any Internet core routers should ever see any RFC1918 addresses... right? Or am I missing something?
Nov
28
comment Spoofing IP address as being local over the Internet
I assume "@IP" is shorthand for "IP address" or something? And you only mention ingress filtering, but what about egress filtering by my ISP or other core Internet routers? That is also part of the answer to the question whether it'll arrive on the other end.
Nov
25
comment Is the same browser equally safe on a different OS?
@RS I don't know, I'd assume it's mostly the same between operating systems, not considering ASLR and such.
Nov
22
comment Decoding base64 encoded message with a key
@dave_thompson_085 Yeah I can't imagine what they were thinking to design this either, but a custom alphabet would be implemented in code, not stored in the database I'd think, so this would have to be for encryption... then again, abhi_kaffe just mentioned each row is the same, so perhaps they really did just want to use a custom alphabet for some reason.
Nov
21
comment Decoding base64 encoded message with a key
In earlier comments you said the field was 64 characters long but this is 134 characters long, which is not even divisible by 64. I can't really tell you what you're supposed to do with this...
Nov
6
comment not allowing pasting of bank account number
"It's for the same reason "paste" is disabled on the email/verify email, on signup forms." Yeah about that, please kill anyone doing this.
Nov
6
comment IMG tag vulnerability
@nodebase Look in the HTTP headers.
Oct
24
comment Some questions about port-scans
@Inquisitive Since the default is to not respond (on most consumer routers), yes, that is usually the case. I'm glad you found the explanation useful!
Sep
8
comment What is the security flaw in the following code?
"Stored password is compared against clear-text password provided by user" I have never heard that this is a bad practice. Perhaps if the password propagates through a network or system to finally be checked, you might want to encrypt or hash it for transport, but other than that... if you didn't hash it client side (hello, mobile app developers!) there is usually little point in hashing it and then using it right after. Still, an upvote, you didn't say anything incorrect and there are some good points :)
Aug
1
comment SIP DoS classifications
Thanks! As for why, it's a community guideline (see "Provide context for links"). I do see your point though!
Aug
1
comment SIP DoS classifications
It's recommended to highlight the most important parts of the article you linked in case the link goes dead.
Jul
10
comment How does the password become 30,000 times stronger?
@JekwA Using 7-bit ASCII, I count 127-32=95 printable characters. Minus 10 digits and 52 letters (uppercase and lowercase), you get 33 special characters, which includes space. Excluding space you have 32 special characters. Both get close to 30,000 (one above, one below).