384 reputation
18
bio website
location
age
visits member for 1 year, 11 months
seen Jul 24 at 10:43

Jun
27
answered What prevents this session hijacking from occurring? (SMB/CIFS example)
May
3
awarded  Excavator
May
3
revised Security of passphrase-protected private key
Use the URL for the blog post, instead of the URL for the _source code_ of the blog post. I don't think we need to be that hardcore.
May
3
comment Security of passphrase-protected private key
Thanks. Also looks like OpenSSH have recognized this as a problem and started to offer a solution with bcrypt (although it's not the default yet): lwn.net/Articles/590870
May
3
suggested suggested edit on Security of passphrase-protected private key
Feb
10
comment How do I ensure data encryption on Samba transmission on *NIX systems?
I think you found the answer, and the answer was no :). What you found was not implemented by MS, as requested in the question. "An innovation created by the Samba Team, Samba 3.2 has extended the CIFS/SMB protocol to allow transport encryption ... This extension to the CIFS/SMB protocol is open and available for other vendors to adopt."
Aug
11
awarded  Yearling
Jun
2
comment Why does this XSS vector work in svg but not in HTML?
If anyone else is wondering where this is talked about in the spec... the contents of <svg> are parsed as "foreign content". (<mathml> too). I feel unclean...
Mar
13
comment What is the next step of this file upload attack?
Maybe they were trying to upload a file named script.php.jpg. Some apache configurations would run this as a php script. See e.g. core.trac.wordpress.org/ticket/11122
Mar
13
comment CSRF with OAuth or Bearer Authorization headers
I can't work out what you're asking for. You struggle with passing a CSRF token around. Surely you still have to pass session information around with OAuth. (You specifically don't want the browser to handle it automatically). Also, XHR draft spec suggests (though I have not tested) you could set an Authorization: Basic header manually; the browser wouldn't cache that.
Mar
13
answered Are smartphones at least as safe as “regular” computers for personal data?
Mar
13
comment Are smartphones at least as safe as “regular” computers for personal data?
Simple Windows/Linux/Mac passwords protect your data from a casual, physical intruder. Otherwise - non-physical attacks, Linux-happy 12-year-old - it's not going to help :).
Feb
5
awarded  Informed
Feb
5
comment is there a safe way to login to my gmail account from a public pc?
@RTOSKit private browsing disables extensions for this very reason, at least in Firefox and Chrome
Feb
3
comment How does the Yahoo webmail exploit work?
Your entire Yahoo account was compromised, so yes to most of your concerns. They couldn't have enabled anything Yahoo wouldn't have let you enable, so I guess forwarding is not a problem. Changing your password should have cut off any future use of the stolen login cookie (Yahoo would have to be even more backwards to neglect that). The news articles don't suggest what the objective was. It sounds like a relatively short term attack... one of the answers suggests the harvested contact addresses would also be used for future spam, so maybe that's what they were after.
Feb
3
comment is there a safe way to login to my gmail account from a public pc?
Good (practical) idea, if you bear in mind the caveats on other answers. For a "sometimes" thing, it might be easier to remember the menu location though. Rather than keyboard shortcuts, on an unfamiliar browser.
Feb
3
comment is there a safe way to login to my gmail account from a public pc?
I do wonder how exposed that leaves you when the smartphone is lost/stolen :). OTOH, that may be a more well-understood threat (by users as well as service providers).
Feb
2
answered How does the Yahoo webmail exploit work?
Feb
2
answered is there a safe way to login to my gmail account from a public pc?
Jan
22
comment Protecting peers communicating with WebRTC
@Tsahi I would make a comment on your blog (which is off-topic here), but it seems to think I'm a bot. alan.christopher.jenkins@gmail.com