7,297 reputation
928
bio website
location
age
visits member for 2 years, 8 months
seen 9 hours ago

Apr
23
answered Why do HTTPS requests include the host name in clear text?
Mar
29
answered Setting up a security lab, looking for a little guidance
Mar
27
comment Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?
TrueCrypt? You can use it under either OS, but it may not be as transparent as you like.
Mar
27
reviewed Approve How does Bayesian poisoning work?
Mar
27
comment What kinds of PE file infection can AV software detect?
No, AVs don't check system file signatures, they only check their own lists' signatures. And yes, a heuristic might be to look at entry points, but AV vendors don't typically publish their list of heuristics. You could check out ClamWin at sourceforge.net/p/clamwin/code/ci/master/tree if you're interested.
Mar
25
answered What kinds of PE file infection can AV software detect?
Mar
24
answered Hide the fact of e-mail communication
Mar
24
comment How valuable is a Cybersecurity major?
A computer science major can get a job in either software programming or cyber security, but the reverse is not true. A cybersecurity major likely won't be as qualified for a job in programming.
Mar
20
comment Reducing hash output length
I used that as an example because some of the broken hash algorithms had collisions that required just a few bytes of permutation at the end. (The attack that forged certificate signatures by exploiting this weakness in MD5 a few years back took advantage of this.)
Mar
20
comment Reducing hash output length
Regarding meaningful text sentences, those are even more enabling of manipulation because humans can easily be fooled. An attacker might attempt to generate collisions by appending or inserting whitespace, non-printable characters, or by inserting Unicode glyphs that look like English characters.
Mar
20
comment Trouble understand login vulnerabilities
Ah. There are entire classes of attacks based on running arbitrary SQL. The attacker could insert x' or 1=1 in the password field, hoping the resultant SQL would look like select auth_level from users where password='x' or 1=1 There are ways of structuring queries to discover table schema, user lists, or even the classic Robert';drop table students (Little Bobby Tables, as his mom calls him.)
Mar
20
comment Trouble understand login vulnerabilities
OWASP's page answers your question about escaping the apostrophe. Go down to owasp.org/index.php/…
Mar
20
answered Trouble understand login vulnerabilities
Mar
15
answered Secure software development checklist
Mar
14
answered Getting password cracking time and byte storage from bruteforce?
Mar
10
answered Why would you decouple your resource and login servers?
Mar
5
answered CSR Signing simulation
Mar
3
revised How to make undetectable malware
fixed incorrect word
Mar
3
answered How to make undetectable malware
Mar
3
revised Do all non-CA certs have to be End Entity certs?
added 105 characters in body