29,070 reputation
23073
bio website
location Troy, NY
age 30
visits member for 2 years, 1 month
seen 9 hours ago

15h
comment What are some good website security scanning solutions?
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post.
Oct
17
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Riking - I was more indicating that Cloudflair should be de-trusted for behaving in an insecure manner. Using SSL only to their servers is insecure and I'd argue an abuse of the system. We could consider an extension to SSL to say something is a proxy cert, but honestly, I don't see enough value in such a service. It doesn't protect from anything other than ISP spying or a spying device installed on the user's local routing path. It is something, but still leaves a lot open.
Oct
14
comment Are single case alphanumeric passwords the most user friendly?
@Peter - right, I'm agreeing that a longer password with less complexity is fine and may be more usable for some. Practically though, we don't want to require a 13 character password if the user prefers to use special characters and we can't only require 8 characters without checking the complexity or they might just enter an 8 character lower case password. I was proposing a way of checking the complexity while still allowing the user to use whatever type of password they prefer.
Oct
14
comment What is public key pinning
There are way to many possible ways to enumerate here, but I added a couple to the post.
Oct
14
comment I need help on how to hack into a scammer computer via IP/DNS
Committing a crime is not a valid response to a crime. Report him to the authorities and hand off the information you have gathered (which thus far seems like it was probably legally acquired, though I am not a lawyer).
Oct
10
comment Is it possible to demonstrate that md5(x) != x for any x?
This might be a better fit for cryptography. I'm really not sure how this is security related.
Oct
10
comment Best practices for OAuth 2.0
Which role of oAuth are you filling?
Oct
9
comment future of graphical password authentication
How do you hash something that is going to inherently not be exact each time? Similarly, how many people are going to actually choose a pattern that isn't outlining some part of the image and think that they are then secure? Plus anyone watching you log in can easily copy it. At least passwords are a little hard to tell what they typed unless you use a camera.
Oct
9
comment future of graphical password authentication
While I don't think the question is answerable in it's current form. I think it is important to point out that NO, WINDOWS 8.1 PHOTO PASSWORD ISN'T SECURE. It's horrible, horrifying, awful, stupid, don't use it, crazy insecure. You can't hash it and still get a reliable input and most people are going to actually draw on something in the image, which makes it FAR, FAR, FAR easier to break than even a fairly weak password. (Not to mention easier to shoulder surf.)
Oct
9
comment What actually happens in “low voltage fault attacks”
Yeah, if you could provide your own power supply or check on the power level in a way that it can't be tampered with without making it detectable, it would effectively counter the covert portion of this attack, though it wouldn't prevent the leakage, so it doesn't prevent the success of the attack, just allows for it to be detected. The more proper fix is to correct the faults in the algorithm that allow for the leakage (if possible).
Oct
9
comment How safe is it for an app to trust a click on a link in an email?
@ThoriumBR - the idea is that the token should be of limited usefulness. It shouldn't allow unlimited posting.
Sep
29
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Dr.McKay - that's the thing though, the place to do that is in the certificate. If Cloudflare is putting up certificates that don't make the state of the connection clear, then they should be stripped of trust until they fix the problem, just like we'd strip any other major misbehaving CA of not behaving in a trustworthy manner. That is how the SSL system is designed to operated, we don't need some new solution to a problem that is already solved.
Sep
22
comment Task Manager and Keyloggers
@user2813274 - sure they can be made cheaply and are easily available, but the chances of someone actually encountering one are far FAR less likely than a software keylogger since they require physical access to the box to implement and most people don't merit that kind of targeted effort.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
@HocusPocus - actually, if it is demagnetized, the read head should get a bunch of nothing rather than an error. An error might still be magnetized with some information uncorrupted.
Aug
28
comment Good way to make a secure token for logged out users
Based on the scenario you describe, you are not actually using a logged out user, but rather a second login system with a cookie persisted session that doesn't actually require a login to start it.
Aug
26
comment Interesting security demos for beginners
While this may have the start of a "good subjective" question, I'm not sure it is quite tightly defined enough. In particular, the audience is still fairly broad and the goal relatively wide. Is there any way you might be able to narrow it down a bit? For example, what kind of interest are you trying to inspire?
Aug
23
comment Could a neighbour see my traffic when we have cable Internet?
@bobuhito - it depends on the type of network. Fiber to the neighborhood serves a larger number of customers per fiber line because it is using a coaxial distribution network. In fiber to the curb (what at least my local Road Runner uses), it is around 32 to 64 passively split fiber lines to one end point. Fiber to the premise (such as FIOS uses a similar split). This wikipedia article may be more helpful.
Aug
19
comment How can I prevent my database from being compromised if my CakePHP app is compromised?
@Dominicp yes, if you decrypt on the server then a persistent attack is still a problem, but it still prevents mass compromise of anything not accessed. If you really need Max security you could have decryption done client side but that'd be tricky.
Aug
18
comment Can we trust antivirus software?
@Agent_L - right, sorry if I wasn't clear, I wasn't disagreeing with you that a virus in a high privilege process isn't a bigger threat, but the question doesn't ask how much of a threat it is, it asks if we can trust AV software. There is no reason to suspect AV software any more than anything else, including the OS itself. I was just pointing out why I didn't mention your point in my answer.
Aug
15
comment How does iOS prevent unauthorised code from running?
@raz - sorry, I'm thinking as a developer where the OS itself is also an application of types. Beyond the kernel, most of the functionality is provided by applications that run as part of the OS, but any high privileged application could be used in theory. I switched it to use the term "high privileged code" to be more clear.