meta user
network profile
| bio | website | paralint.com |
|---|---|---|
| location | Montreal, Canada | |
| age | ||
| visits | member for | 2 years, 4 months |
| seen | 23 hours ago | |
| stats | profile views | 49 |
I like smart people who get things done. I do my best everyday to be one of them.
I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.
|
May 31 |
comment |
Oracle Internet Directory (OID) hardening OID requires anonymous search to be enabled if you want to register a database in it. Technotes ID 305371.1, 455031.1, 262560.1 and 456766.1 have more information. I gave up after weeks of hard work, looking at ldap traces and fidling with ACI ... |
|
Feb 4 |
comment |
Picking an encryption algorithm for auth tokens passed via AJAX Should you decide to do cryptography in the browser, you might want to look at the Stanford Javascript Crypto Library. |
|
Feb 4 |
comment |
Picking an encryption algorithm for auth tokens passed via AJAX Beware : manipulating cookies with javascript will prevent you from using http only cookies, which increases the risk associated with cross-site scripting (XSS). Complexity is the ennemy of security. |
|
Nov 29 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? Very true, @mehaase. I have updated my answer below to mention its limits. |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? This prevents an attacker from getting a valid session cookie, maybe by starting a registration process, and forcing you to authenticate using that session cookie. The attacker does not have the password, but is valid session cookie is now authenticated. Asking the old password when you change your original password prevents further damages. |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? I don't know about a formal guidance, but a server could add a something like a version, like a counter or a timestamp, to the authentication cookie. So when a request comes in, the server would : 1. Decrypt the cookie or verify that it was not tampered with 1. Read the password version or timestamp that was valid when the cookie was generated 1. If the password version or timestamp is older, prompt for authentication again. This might be harder to do in other environments. For example, a Kerberos ticket held by an attacker will stay valid after you reset your password. On the web, GMail has t |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? Your password is used when you authenticate only. Cookies take it from threre. Changing your password does not change your cookies. You can clear your cookies, but the attacker who logged in with your old password won't :) |
|
Nov 23 |
comment |
Public key Infrastructure @Zzz you have the answer, post it ! |
|
Jul 30 |
comment |
Can my company see what HTTPS sites I went to? Yes, indeed ! You would have to compare fingerprint and such wich is very very unlikely to happen. |
|
Jun 22 |
comment |
Can a biometric device serve as a user based entropy source? I like your comment, make it an answer ! |
|
Jun 22 |
comment |
Can a biometric device serve as a user based entropy source? Right, entropy might not be the best word to describe this. What I meant is that if were to compare all keys for all users, I would see that they are totally random, i.e. there is no way to predict one even if you know all the others. |
|
Jun 5 |
comment |
Is it possible to use same certificate on several machines by exporting it? Very true. I would add that the "non-exportable" flag of any certificate is just that, a flag. If it is stored in a software container, getting the key is always feasible. |
|
May 22 |
comment |
Two-factor authentication w/certificate and username & password? Right. Never store the password on the device. And to be considered two factor, a certificate must be store in a tamper proof device. But my interpretation is as good as the next. It depends on your threat model and tolerance to risk. |
|
May 13 |
comment |
MAC vs Encryption Yes, MD5 is weak, but that's not the point. We did not mention algorithm either. And what is a MAC other than an encrypted hash, like I proposed ? The message, along with the hash is encrypted. +Thanks for the link, I will use it next time I will give my introduction to cryptography class. |
|
May 11 |
comment |
MAC vs Encryption Yes, I added a conclusion to sum it up. |
|
May 8 |
comment |
Physical computer security, how to disable USB ports when the computer is 'locked'? In that scenario, you should also worry about FireWire, which has DMA support |
|
Apr 25 |
comment |
TLS Renegotiation Indication Extension vulnerability Right, the MITM can't decrypt, only inject. I've edited my answer for that point and take the -1, hoping that my edited answer is now correct, if not as well laid out as the others. |
|
Aug 5 |
comment |
Slow client key exchange in TLS? Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ? |
|
Aug 4 |
comment |
How can I mitigate the threat that DPAPick poses to my DPAPI protected data? I agree with @Casebash : if you have the password, access the data using CryptUnprotectData in a custom data extraction tool if needed. It is nice to have DPAPI reversed engineered, though. |
|
Aug 2 |
comment |
Is the following authentication scheme secure? You got -1'ed? That question is valid. |
