372 reputation
17
bio website
location
age
visits member for 1 year, 8 months
seen 3 hours ago

Feb
10
comment How do I ensure data encryption on Samba transmission on *NIX systems?
I think you found the answer, and the answer was no :). What you found was not implemented by MS, as requested in the question. "An innovation created by the Samba Team, Samba 3.2 has extended the CIFS/SMB protocol to allow transport encryption ... This extension to the CIFS/SMB protocol is open and available for other vendors to adopt."
Aug
11
awarded  Yearling
Jun
2
comment Why does this XSS vector work in svg but not in HTML?
If anyone else is wondering where this is talked about in the spec... the contents of <svg> are parsed as "foreign content". (<mathml> too). I feel unclean...
Mar
13
comment What is the next step of this file upload attack?
Maybe they were trying to upload a file named script.php.jpg. Some apache configurations would run this as a php script. See e.g. core.trac.wordpress.org/ticket/11122
Mar
13
comment CSRF with OAuth or Bearer Authorization headers
I can't work out what you're asking for. You struggle with passing a CSRF token around. Surely you still have to pass session information around with OAuth. (You specifically don't want the browser to handle it automatically). Also, XHR draft spec suggests (though I have not tested) you could set an Authorization: Basic header manually; the browser wouldn't cache that.
Mar
13
answered Are smartphones at least as safe as “regular” computers for personal data?
Mar
13
comment Are smartphones at least as safe as “regular” computers for personal data?
Simple Windows/Linux/Mac passwords protect your data from a casual, physical intruder. Otherwise - non-physical attacks, Linux-happy 12-year-old - it's not going to help :).
Feb
5
awarded  Informed
Feb
5
comment is there a safe way to login to my gmail account from a public pc?
@RTOSKit private browsing disables extensions for this very reason, at least in Firefox and Chrome
Feb
3
comment How does the Yahoo webmail exploit work?
Your entire Yahoo account was compromised, so yes to most of your concerns. They couldn't have enabled anything Yahoo wouldn't have let you enable, so I guess forwarding is not a problem. Changing your password should have cut off any future use of the stolen login cookie (Yahoo would have to be even more backwards to neglect that). The news articles don't suggest what the objective was. It sounds like a relatively short term attack... one of the answers suggests the harvested contact addresses would also be used for future spam, so maybe that's what they were after.
Feb
3
comment is there a safe way to login to my gmail account from a public pc?
Good (practical) idea, if you bear in mind the caveats on other answers. For a "sometimes" thing, it might be easier to remember the menu location though. Rather than keyboard shortcuts, on an unfamiliar browser.
Feb
3
comment is there a safe way to login to my gmail account from a public pc?
I do wonder how exposed that leaves you when the smartphone is lost/stolen :). OTOH, that may be a more well-understood threat (by users as well as service providers).
Feb
2
answered How does the Yahoo webmail exploit work?
Feb
2
answered is there a safe way to login to my gmail account from a public pc?
Jan
22
comment Protecting peers communicating with WebRTC
@Tsahi I would make a comment on your blog (which is off-topic here), but it seems to think I'm a bot. alan.christopher.jenkins@gmail.com
Jan
21
comment Attract Brute Force SSH Attacks
Have you looked at previous work for ideas? E.g. a quick search found A Study of Passwords and Methods Used in Brute-Force SSH Attacks
Jan
21
answered Is a random keyfile more secure than a derived key?
Jan
20
answered Protecting peers communicating with WebRTC
Dec
9
comment Is it possible to Identify a VPN user by finding relations in traffic?
"inject a little extra HTML code into the response going back to the Web browser". HTTPS. One of us is missing something here. (Note that I conceded "securable" not "secure", and that this meant Tor was probably unsuitable for most users, and hence the OP).
Dec
7
comment Is it possible to Identify a VPN user by finding relations in traffic?
Hmm, yes, that's a general caveat to TOR that I didn't mention. It's securable for online banking, webmail (you use https, right? - and facebook may prompt you to do the same nowadays)... "mixed" (unencrypted) content, not so much. So not really suitable for Windows users, hmm. (E.g. the standard way of installing Firefox is from http...)