27,133 reputation
22661
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 3 hours ago

Jul
28
answered need network level security alternatives to a VPN
Jul
28
answered Are antiviruses still useful?
Jul
27
comment Does a virus need to be clicked on to function?
@JamesSnell if it is in metasploit that alone would counter my question, assuming it allows arbitrary execution.
Jul
26
awarded  authentication
Jul
25
answered pci compliance and temporary files
Jul
25
answered Isnt the 3D secure system essentially completely ineffective in avoiding fraud?
Jul
25
revised Single sign on - is this a secure way to log in?
deleted 209 characters in body
Jul
25
comment Single sign on - is this a secure way to log in?
Oh, I see, I misread your post. I'll update my answer momentarily.
Jul
25
answered Single sign on - is this a secure way to log in?
Jul
25
revised Does a virus need to be clicked on to function?
added 71 characters in body
Jul
25
comment Does a virus need to be clicked on to function?
@JamesSnell - If you read my post, I indicate that. It is, however, quite rare for a virus to hook automated processes if it is not brought on to the system through the intended vector. Most viruses are actively delivered. Unless things have changed a lot since I last looked, effective passive delivery is so rare, that while worth a mention and still a good reason to use a VM, the chances are just about as good of a virus designed to escape a VM as one that will hook a system scan or thumbnail viewer or something similar, especially if you disassociate it from it's normal extension.
Jul
25
awarded  Good Answer
Jul
24
comment Does a virus need to be clicked on to function?
@emodendroket - yeah, that was grouped in with "There is a very slim possibility it might be able to abuse some system process." Search indexing, virus scanning itself, other things like that could potentially have issues, but that kind of a vulnerability is pretty rare and being meaningfully exploitable is even more rare since you have to end up evaluating data in such a way that the evaluation of the data can result in a hijacking of the process.
Jul
24
comment Does a virus need to be clicked on to function?
@Ajedi32 - XSS is a major vector for injecting such malicious JavaScript though, if you can prevent that, then the instances of drive by malware goes down significantly. Preventing malware download is one of the main goals of the project. The main point I was getting at was simply that not all Javascript is dangerous, only particular parts. If you can avoid those part, then you are far safer, that can be done by either the client or the server or both as long as the server itself is actually trust worthy.
Jul
24
awarded  Nice Answer
Jul
24
revised Does a virus need to be clicked on to function?
deleted 6 characters in body
Jul
24
revised Does a virus need to be clicked on to function?
added 12 characters in body
Jul
24
comment Does a virus need to be clicked on to function?
@loneboat - mostly by using a separate system. I personally haven't looked in to it that much, but there are projects like Caja Project working on subsets of Javascript that are more secure. I'm not sure if there are any browsers that can currently limit execution to that though.
Jul
24
revised Does a virus need to be clicked on to function?
added 12 characters in body
Jul
24
comment Does a virus need to be clicked on to function?
@PlasmaHH - that's a fair point, there might be a small chance. Those were still more likely bugs that resulted in crashing though. It would be rather hard, if even possible, to hook such a behavior in to causing a code execution, but it might not be impossible. I'd still say it is pretty unlikely, especially for any run of the mill virus. An active infection approach is far more likely.