4,166 reputation
1712
bio website
location Florence, Italy
age 45
visits member for 1 year, 9 months
seen 18 hours ago

Apr
15
comment Is crypto.js vulnerable to heartbleed attack?
I feel @user44548 's worry is understandable. The documentation states that crypto.js "implements" some OpenSSL algorithms. Without a clear picture of what Heartbleed is and does, it is reasonable to be a bit wary; after all, better to be safe than sorry.
Apr
14
comment Is crypto.js vulnerable to heartbleed attack?
@user44548, no, merely "mentioning" a software is not enough to evoke an attack. Even if software engineering does sometimes make one think of forbidden magic. Things would be different if the "mentioning" was actually an executable call. In this case it is not.
Apr
14
answered Is crypto.js vulnerable to heartbleed attack?
Apr
13
revised Protect from Facebook like clickjack
fixed iphone typos
Apr
9
comment How easy is it really to do IP spoofing?
Yes, but many routers actually do not perform so-called "egress filtering". More modern hardware probably will, since memory, computing power and update bandwidth is cheaper now than back in the times, but large parts of the Internet still run on "vintage", more than "ill-configured", hardware. IP spoofers are a minority, and checking all the traffic to cope with it is often not cost effective enough for many ISPs and carriers.
Apr
9
answered How easy is it really to do IP spoofing?
Mar
30
answered Are Truecrypt volumes safe from the government agencies?
Mar
28
answered Hashing algorithms
Mar
22
comment How secure is my system?
I've added some more musings on the topic :-)
Mar
22
revised How secure is my system?
added 3742 characters in body
Mar
22
revised How secure is my system?
added 1405 characters in body
Mar
22
comment How secure is my system?
No, I wasn't too worried about logs, but about private key storage, for example. It looks like you took care of that too :-) (the memory DB you use sanitizes data when releasing memory, right? Just being paranoid, is all). So you also considered session fixation at the user's end, and sanitize records on expiry. I believe you've got better security than 99.9% of sites out there :-)
Mar
22
answered How secure is my system?
Mar
17
comment Using a Proxy to Log Http/s requests and Performance Evaluation
The problem is that to ensure this protection, the user must expose to an increased danger. Normally, transactions are encrypted so that no one (not your proxy, not an attacker) can snoop. To work, your proxy must be able to perform a successful man-in-the-middle attack: it is the equivalent of leaving your front door always open, so that the police may check you aren't being burgled.
Mar
17
comment Using a Proxy to Log Http/s requests and Performance Evaluation
You are trying to make more secure a configuration which is inherently insecure. To work, such a proxy would require the connection to be unencrypted; use an unencrypted connection for secure purposes is folly. Actually, I would not expect a bank to allow an unencrypted transaction to be established in the first place.
Mar
2
revised How to use ESSIV to avoid seeing repeated patterns?
added 65 characters in body
Mar
2
comment How to use ESSIV to avoid seeing repeated patterns?
Yes, the ellipsis should be there (will add). And no, there's a difference in respect with XEX because XEX does encryption, while we're just XORing and using a hash function. The approach is however analogous, yes.
Mar
2
revised Don't understand how my mum's Gmail account was hacked
added 216 characters in body
Feb
27
answered Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?
Feb
27
revised Don't understand how my mum's Gmail account was hacked
added 949 characters in body