29,580 reputation
23176
bio website
location Troy, NY
age 30
visits member for 2 years, 2 months
seen 1 hour ago

8h
comment How to report vulnerabilities without being regarded as a hacker?
@schroeder - fair enough, I would concur that it is probably best to make the most understandable and simplest explanation possible. People are less likely to freak out (justifiably or not) if you are using tools they understand instead of stuff that goes over their heads.
8h
comment How to report vulnerabilities without being regarded as a hacker?
@schroeder - but this doesn't even require capturing the packets (which, btw, you have to do to see a page). It only requires looking and seeing http:// instead of https:// when you mouse over the link submission or viewing the source of the page. It can be done right from the browser.
1d
comment Example websites that have invalid certificates
Delete all your root certificates and they all will be.
Oct
27
comment Forensic Question Invisible User
@Raven - you think incorrectly. They could also be used for scheduled tasks, configured to be the user that runs a link for a user, or any of a number of uses where a process has to occur on a privilege set other than a normal user. You shouldn't have to tweak anything in the registry for them. That would be horribly unusable and lead to errors, which would be bad for security. It doesn't have a user profile because it doesn't need one. Again, this is working as designed and is not an issue, you simply don't understand their usage correctly.
Oct
27
comment {Secure} Telnet connect to a console server from webbrowser
In that case, the security related answer is either chain the VPN connections or use an encrypted web server connection. Designing a website that could be used as a Telnet client is off topic though as it isn't security related. It sounds like the security related portions of the question are answered now.
Oct
27
comment Forensic Question Invisible User
In other words, the behavior you describe is not a security issue and is working as intended.
Oct
27
comment Forensic Question Invisible User
@raven - service users should have passwords and can have low priviledge if that is all they need. They also don't have to be associated with a windows service, that's something entirely different from a service user. Service users can be used for a number of other reasons. Often they are configured to not allow being used by a user for logon, but sometimes they have to be able to login and act like a user. Putting a user in both Services and Remote Desktop Users is a bit odd, but still not a security concern as the behaviors are still logged on a properly configured box.
Oct
22
comment UPS my choice — How can I access my public records?
@SnakeDoc - it's all public records. Birth certificates and places of residence. Mail forwarding services, etc.
Oct
21
comment What is the difference between “key length” and “bit strength”?
@woliveirajr - not sure I see how that is a duplicate. It gets at a kind of similar concept, but doesn't even mention key length specifically, just ambiguous strength.
Oct
17
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Riking - I was more indicating that Cloudflair should be de-trusted for behaving in an insecure manner. Using SSL only to their servers is insecure and I'd argue an abuse of the system. We could consider an extension to SSL to say something is a proxy cert, but honestly, I don't see enough value in such a service. It doesn't protect from anything other than ISP spying or a spying device installed on the user's local routing path. It is something, but still leaves a lot open.
Oct
14
comment Are single case alphanumeric passwords the most user friendly?
@Peter - right, I'm agreeing that a longer password with less complexity is fine and may be more usable for some. Practically though, we don't want to require a 13 character password if the user prefers to use special characters and we can't only require 8 characters without checking the complexity or they might just enter an 8 character lower case password. I was proposing a way of checking the complexity while still allowing the user to use whatever type of password they prefer.
Oct
14
comment What is public key pinning
There are way to many possible ways to enumerate here, but I added a couple to the post.
Oct
14
comment I need help on how to hack into a scammer computer via IP/DNS
Committing a crime is not a valid response to a crime. Report him to the authorities and hand off the information you have gathered (which thus far seems like it was probably legally acquired, though I am not a lawyer).
Oct
10
comment Is it possible to demonstrate that md5(x) != x for any x?
This might be a better fit for cryptography. I'm really not sure how this is security related.
Oct
10
comment Best practices for OAuth 2.0
Which role of oAuth are you filling?
Oct
9
comment future of graphical password authentication
How do you hash something that is going to inherently not be exact each time? Similarly, how many people are going to actually choose a pattern that isn't outlining some part of the image and think that they are then secure? Plus anyone watching you log in can easily copy it. At least passwords are a little hard to tell what they typed unless you use a camera.
Oct
9
comment future of graphical password authentication
While I don't think the question is answerable in it's current form. I think it is important to point out that NO, WINDOWS 8.1 PHOTO PASSWORD ISN'T SECURE. It's horrible, horrifying, awful, stupid, don't use it, crazy insecure. You can't hash it and still get a reliable input and most people are going to actually draw on something in the image, which makes it FAR, FAR, FAR easier to break than even a fairly weak password. (Not to mention easier to shoulder surf.)
Oct
9
comment What actually happens in “low voltage fault attacks”
Yeah, if you could provide your own power supply or check on the power level in a way that it can't be tampered with without making it detectable, it would effectively counter the covert portion of this attack, though it wouldn't prevent the leakage, so it doesn't prevent the success of the attack, just allows for it to be detected. The more proper fix is to correct the faults in the algorithm that allow for the leakage (if possible).
Oct
9
comment How safe is it for an app to trust a click on a link in an email?
@ThoriumBR - the idea is that the token should be of limited usefulness. It shouldn't allow unlimited posting.
Sep
29
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Dr.McKay - that's the thing though, the place to do that is in the certificate. If Cloudflare is putting up certificates that don't make the state of the connection clear, then they should be stripped of trust until they fix the problem, just like we'd strip any other major misbehaving CA of not behaving in a trustworthy manner. That is how the SSL system is designed to operated, we don't need some new solution to a problem that is already solved.