26,605 reputation
22661
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 31 mins ago

Mar
11
answered Criteria for an ADSL wireless modem
Mar
11
answered Is STARTTLS a security-vulnerability?
Mar
7
reviewed No Action Needed Is “bug banking” occurring?
Mar
7
reviewed Close How to start career as Penetration Tester?
Mar
7
reviewed Close Does it make any sense to alter a hashed password?
Mar
6
reviewed Close Storing hashed or encrypted password in session?
Mar
6
reviewed Leave Open Books about Penetration Testing
Mar
6
reviewed Approve suggested edit on How to avoid scripts with hardcoded password?
Mar
6
comment Installing profile on “Good” Mail application give someone admin permission on my iPhone
Additionally, do you trust that Good placed sufficient security around their control protocols to avoid hijacking of the wipe controls.
Mar
5
reviewed Approve suggested edit on Is it worth it to get paid anti-virus software?
Mar
4
comment Wouldn't transient cookies for session management increase effectiveness of MITM?
@ole session ids should be impossible to guess and if a transient cookie is used then unless the local machine is compromised then the key isn't going to leak. Killing the cookie on browser close is the best possible option since you need some way to keep a session. Yes it is best if they actively log out but there is no way to force that and no substantial attack against the cookie that couldn't be taken against the logout anyway.
Mar
4
revised Wouldn't transient cookies for session management increase effectiveness of MITM?
added 469 characters in body
Mar
4
comment Wouldn't transient cookies for session management increase effectiveness of MITM?
@OleMartinHandeland - MITM how? If it is only exchanged over SSL, then MITM isn't possible. If user's machine itself is compromised, the attacker could prevent any attempt to log out too and make it look like clicking the logout happened when really they do their own thing.
Mar
4
comment Are virtual keyboards themselves secure?
@user3280126 - most of the claims seem fair and if the company is trust worthy, it would avoid a few possible keylogger mechanisms, but they provide no evidence of how they supposedly counter the most common type of OS event keylogger. Without exposing a direct interface to the keyboard from an application, I don't know how else they plan on sending the events to avoid OS events being fired. My guess is they are probably copying and pasting the character rather than using a keystroke and then clearing the paste buffer, but a good keylogger should still be able to pick that up.
Mar
4
comment Are virtual keyboards themselves secure?
@user3280126 - your entire premise itself is wrong though. Virtual keyboards provide zero protection against keyloggers. Keyloggers don't look at the input from the keyboard. Keyboard input goes directly to the OS. Keyloggers look for key press events published by the OS and virtual keyboards cause the exact same events to fire. To a keylogger, it doesn't matter where you press the button. You can never get around that because the application itself looks for the OS events. The only way would be for the application itself to provide a virtual keyboard. That could avoid the OS entirely.
Mar
4
answered Wouldn't transient cookies for session management increase effectiveness of MITM?
Mar
4
comment Are virtual keyboards themselves secure?
possible duplicate of Protection against screenshot key loggers
Mar
3
answered How much faster would computers be if not for security?
Mar
3
answered What is the difference between HSM and Key server?
Mar
2
comment two encrypting / hashing case, which one is best
Right, unless I missed something the second example is just the second half of the first. The second part of it is fine as long as the iterations are high enough but the first call is just a waste of time.