7,415 reputation
928
bio website
location
age
visits member for 2 years, 9 months
seen 1 hour ago

7h
revised Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?
added 124 characters in body
7h
revised Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?
added 596 characters in body
7h
answered Is WPA(2)/AES or some derivative really perfectly secure?
8h
answered Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?
1d
answered How hard would it be to scramble crypto keys in memory on command?
1d
comment What is the difference between XOR and poly-XOR?
Please define "polyxor encryption" as that is not a standard term. Then define what exactly you mean by "XOR encryption" in terms of key length, key generation. I think once you've answered those questions well enough for anyone to help you, you'll have your answer.
May
15
comment Threat Modelling Application Decomposition
@AdamShostack, that's why I posted my answer. I found his diagram hard to use because it isn't looking at actual boundaries, but only ideas about where boundaries might be, and those ideas may or may not be correct (as in what lies between his HTTPS and database boundaries? A web server, an app server, or both?) Starting from the system architecture, I would know where to draw those lines.
May
5
comment How does SSL/TLS PKI work?
security.stackexchange.com/questions/51558/… might help answer #4
Apr
30
answered Threat Modelling Application Decomposition
Apr
23
answered Why do HTTPS requests include the host name in clear text?
Mar
29
answered Setting up a security lab, looking for a little guidance
Mar
27
comment Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?
TrueCrypt? You can use it under either OS, but it may not be as transparent as you like.
Mar
27
reviewed Approve How does Bayesian poisoning work?
Mar
27
comment What kinds of PE file infection can AV software detect?
No, AVs don't check system file signatures, they only check their own lists' signatures. And yes, a heuristic might be to look at entry points, but AV vendors don't typically publish their list of heuristics. You could check out ClamWin at sourceforge.net/p/clamwin/code/ci/master/tree if you're interested.
Mar
25
answered What kinds of PE file infection can AV software detect?
Mar
24
answered Hide the fact of e-mail communication
Mar
24
comment How valuable is a Cybersecurity major?
A computer science major can get a job in either software programming or cyber security, but the reverse is not true. A cybersecurity major likely won't be as qualified for a job in programming.
Mar
20
comment Reducing hash output length
I used that as an example because some of the broken hash algorithms had collisions that required just a few bytes of permutation at the end. (The attack that forged certificate signatures by exploiting this weakness in MD5 a few years back took advantage of this.)
Mar
20
comment Reducing hash output length
Regarding meaningful text sentences, those are even more enabling of manipulation because humans can easily be fooled. An attacker might attempt to generate collisions by appending or inserting whitespace, non-printable characters, or by inserting Unicode glyphs that look like English characters.
Mar
20
comment Trouble understand login vulnerabilities
Ah. There are entire classes of attacks based on running arbitrary SQL. The attacker could insert x' or 1=1 in the password field, hoping the resultant SQL would look like select auth_level from users where password='x' or 1=1 There are ways of structuring queries to discover table schema, user lists, or even the classic Robert';drop table students (Little Bobby Tables, as his mom calls him.)