625 reputation
17
bio website michaelhendrickx.com
location Dubai, United Arab Emirates
age 32
visits member for 1 year, 10 months
seen 7 hours ago

Entropy isn't what it used to be.


Apr
16
comment Secure Custom Registration Links
I think that's what he meant with the "site.com/very-long-random-nonce"; it could still be intercepted though.
Apr
1
comment Hardware-restricted root login
There's a PAM module for this: pamusb.org. It allows 2 factor authentication with a USB dongle.
Mar
31
comment Storing database password in application
I was merely talking about the stored passwords, as the question indicated. I should've added encryption for data in transit, but didn't think that was the question.
Mar
30
comment HTTP/HTTPS on the same site
SSL merely implements confidentiality, data integrity and authenticity, this is challenged by MiTM. Attacks against websites will remain to exist, regardless of SSL. Oh, and the client can be also be hijacked, etc.
Mar
30
comment HTTP/HTTPS on the same site
Anybody who sits between your machine and the target site can be an attacker. This can range from network admins / proxy admins (also at the website's end), ISP's and governments.
Mar
29
comment Verifying integrity of text files
That would mean a source code audit. Tools such as IBM's appscan exist to help you with this task.
Mar
27
comment Do I keep my PHP simple auth session secure enough?
If your user remains "logged" in, and goes to another IP address (wifi <-> 3g, or renewed his external IP, ....), or when he upgrades the browser, you'll end his session?
Mar
19
comment Is there a difference between GET and POST for web application security?
In technologies such as REST
Mar
17
comment Separation of secure login steps
Sorry to be such a pain, but can you define "entered". Is there any data submitted to the server?
Mar
17
comment Separation of secure login steps
"only revealed when [...] have been entered". Do you when they are entered on the client side, or submitted to the server?
Mar
17
comment How to react when under attack
I think log files could give you an indication whether the attackers are after a particular thing, or just want to deface you. Taking the site offline might just be delaying the execution, and it affects your legitimate users.
Mar
12
comment Security checks on file transfer
Depends if he wants more than just integrity checks, such as confidentiality.
Mar
12
comment Security checks on file transfer
Is this specifically for PDF files, or general in-transit security?
Mar
11
comment Is there any way to restrict multiple access to my server at the same time using one client certificate?
Is it possible to put a passphrase on it? it becomes something you have and something you know then.
Feb
20
comment Hydra gives wrong passwords
You need more information about the page you're attacking. Try a manual test with curl or so, and see if the page actually sends "Fail " (with space) back to you, which is what you are searching for.
Jan
28
comment Security against IP Spoofing without consulting network administrator
Normally ISP's will protect it, to only allow outbound traffic from IP ranges that they own. Are these the network administrators you talk about? For internal networks, it would also be done with routers / switch ACL's (Access Control Lists). If you don't have access to the network equipment, it's difficult to see where the packet really originated form.
Jan
20
comment Form submissions over HTTPS are not encrypted?
From the Blackhat talk @ media.blackhat.com/bh-eu-12/Jarmoc/…, you can see that a Proxy (and Burp is acting as your proxy) would present itself to be your target site; with their own CA (hence the warning), so they can decrypt everything.In its own turn, it forwards your requests to the real site as a client.
Jan
19
comment Getting access to MAC address of access point from a device wired to the network
I'm not a 100% sure (and Google's pages are quite vague around that), would Google store any other MAC addresses aside from the WLAN interface of AP's? But then again, Google's been found to store more information than they should have.
Aug
13
comment How “enforcable” are email disclaimers
"due to breach of informal contract" Doesn't a contract always need to be accepted by both parties? If never accepted, how can one breach it?