Reputation
12,770
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
2 21 44
Newest
 Good Answer
Impact
~430k people reached

1d
reviewed Leave Open How could Craig Wright obtain Satoshi Nakamoto's private key?
1d
reviewed Leave Open Single Page Application with REST API backend based on XML, queried by dynamic XPath
1d
reviewed Close Why more Android applications (compared to iOS) use certificate pinning?
1d
comment Practical Attacks on Mifare Classic Chips
Look in the src/mfcuk.c file.
1d
reviewed Leave Open Can a full SSD or HDD recover deleted data?
1d
reviewed Close If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type?
1d
reviewed Close Block a website to Other Users, But the router can access it
1d
reviewed Leave Open Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?
1d
reviewed Leave Open Raspberry Pi IDS/FireWall - Should I?
1d
comment Practical Attacks on Mifare Classic Chips
@AndréBorie, mfcuk cracks the first key in 2 or 3 minutes, then mfoc recovers the rest of the keys from the card, according to github.com/nfc-tools/mfcuk
2d
answered How to properly hash a key? big vs small digest
2d
comment What are the alternatives to door passcodes?
Biometrics have two main problems when applied to security: the human body wasn't designed to guard bits of it as "secret", so biometric data can be read and presumably duplicated. And once compromised, they can't be changed. The rest of your cons are less important or have workarounds - if my registered finger is lost in an accident, or my image changes with age or a stroke, I can go re-register my current biometrics with the security team.
Apr
23
answered Why don't the majority of today's malware use strong cryptography?
Apr
23
answered Why gethosbyname() is as bad as gets() by design?
Apr
15
answered What advantage would someone gain by installing my root certificate?
Apr
15
comment Security requirements for one time access code/token in the url
Since you're sending it via SMS, you'd strengthen this quite a bit if the token were valid for only one login. Allowing the token to be used for a limited time period, say 24 hours, might also help. If you allow reuse of the URL, consider limiting the subsequent logins to the same browser that made the original request, validated with cookies distributed during the first login.
Apr
14
comment Should I use a cryptograpically secure random number generator when I generate IDs?
Using math.Random() might lead someone to believe that the numbers are securely randomized when they're not. Using sequential numbers is unambiguously clear that you are OK with people analyzing the sequence. It's not just about calling an API, but the big picture.
Apr
13
answered Should I use a cryptograpically secure random number generator when I generate IDs?
Apr
12
comment Exploiting an XSS vulnerability
Keep searching for other vulnerabilities? Phish their team?
Apr
12
comment PCI Definition of “Transmission”
@Motivated, pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf . Section 3 talks about stored data: section 3.4 it says that stored data must be protected. Section 4 talks about network data, it says "Sensitive information must be encrypted during transmission over networks that are easily accessed by malicious individuals." It lists examples of "easily accessed" networks in 4.1. By implication, encryption is not required on "not-easily accessed" networks. That doesn't mean internal encryption is prohibited, or even a bad idea, just that it's not required.