28,280 reputation
22967
bio website
location Troy, NY
age 30
visits member for 2 years
seen 3 hours ago

Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - yeah, if you are using a sufficinently large intermediate hash and are sure it behaves well (truly random distribution) then it should be ok as long as the initial hash is salted and takes long enough to force use of a full enumeration of the intermediate hash space (or at least near full.)
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - Because nothing client side is trusted. An attacker can skip the entire slow process by bypassing the client entirely. You need to make sure you can't build a rainbow table of cheap, fast hash values. It isn't feasible if you salt each and provided the intermediate hash is long enough. Otherwise, you just make a rainbow table of hash values which can be generated at a very, VERY fast rate if they are cheap.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@CodesInChaos - I'd only go for it being slightly less bad. Even using a complex hash to make a "longer" input, it is only key extension and an attacker is going to be able to produce a lot of cheap hashes very easily. Practically, it might not matter if the client side hash output is long and there are no vulnerabilities in either hash that limit the expansion from simple values. It's also important to note that in such a case, you would need to salt both the client and server side hashes. I'm still a bit dubious of the cost vs the benefit though.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@AndyBoura - if you are designing the system such that you can support client side hashing, you have control over the network and server behavior for parts that would have access to the clear text. True, you aren't harmed by hashing it on the client (other than lost time), just so long as you it doesn't significantly impact the amount of hashing you do on the server.
Jul
30
comment pci compliance and temporary files
@mic.sca - good question. I think technically it probably wouldn't be, but I'm not sure that a lot of people consider that risk. It is at least slightly harder to access in a virtual memory file since it is more buried than if it is in a temp file, but technically it could still be compromised by dumping the virtual memory file.
Jul
30
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
@begueradj - no worries. It really isn't necessary. I appreciate the thanks, but this wasn't all that hard of a question once I figured out what you were asking.
Jul
28
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
Let us continue this discussion in chat if you have further clarifications needed. (BTW, like the anti-spam feature in your profile.)
Jul
28
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
At most they may click a button to do something else on the site other than download and infect their system, but it may occur with or without any participation on their part. If the user is trying to download something, it is no longer a drive by download by definition.
Jul
28
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
@begueradj - not all downloads are active clicks. They can be embedded content such as flash apps or movies or whatever other content. It could also be Javascript capable of executing a download operation without a click via some exploit. The key thing of ANY drive by download is that you are not intentionally trying to download ANYTHING. The term "drive by download" is a reference to "drive by shootings" where someone is just walking along minding their own business at gets gunned down by a passing car. Same thing for a drive by download, the victim is just a bystander.
Jul
28
comment Drive-by download attacks: What can cause the file to be downloaded without interaction?
I'll repeat what Graham Hill pointed out, but add to it a bit. This question makes absolutely no sense at all. In both cases described in the article, you are not trying to download anything. The first case is talking about a malformed advertisement (often full screen over the content you are trying to access) that results in execution where it fools the browser in to thinking the click was a download verification, the other uses the website loading itself without any click being necessary at all.
Jul
27
comment Does a virus need to be clicked on to function?
@JamesSnell if it is in metasploit that alone would counter my question, assuming it allows arbitrary execution.
Jul
25
comment Single sign on - is this a secure way to log in?
Oh, I see, I misread your post. I'll update my answer momentarily.
Jul
25
comment Does a virus need to be clicked on to function?
@JamesSnell - If you read my post, I indicate that. It is, however, quite rare for a virus to hook automated processes if it is not brought on to the system through the intended vector. Most viruses are actively delivered. Unless things have changed a lot since I last looked, effective passive delivery is so rare, that while worth a mention and still a good reason to use a VM, the chances are just about as good of a virus designed to escape a VM as one that will hook a system scan or thumbnail viewer or something similar, especially if you disassociate it from it's normal extension.
Jul
24
comment Does a virus need to be clicked on to function?
@emodendroket - yeah, that was grouped in with "There is a very slim possibility it might be able to abuse some system process." Search indexing, virus scanning itself, other things like that could potentially have issues, but that kind of a vulnerability is pretty rare and being meaningfully exploitable is even more rare since you have to end up evaluating data in such a way that the evaluation of the data can result in a hijacking of the process.
Jul
24
comment Does a virus need to be clicked on to function?
@Ajedi32 - XSS is a major vector for injecting such malicious JavaScript though, if you can prevent that, then the instances of drive by malware goes down significantly. Preventing malware download is one of the main goals of the project. The main point I was getting at was simply that not all Javascript is dangerous, only particular parts. If you can avoid those part, then you are far safer, that can be done by either the client or the server or both as long as the server itself is actually trust worthy.
Jul
24
comment Does a virus need to be clicked on to function?
@loneboat - mostly by using a separate system. I personally haven't looked in to it that much, but there are projects like Caja Project working on subsets of Javascript that are more secure. I'm not sure if there are any browsers that can currently limit execution to that though.
Jul
24
comment Does a virus need to be clicked on to function?
@PlasmaHH - that's a fair point, there might be a small chance. Those were still more likely bugs that resulted in crashing though. It would be rather hard, if even possible, to hook such a behavior in to causing a code execution, but it might not be impossible. I'd still say it is pretty unlikely, especially for any run of the mill virus. An active infection approach is far more likely.
Jul
24
comment Security sanity check
@PwdRsch - well, technically it would be a violation, but a QSA is likely not going to catch it. You can fill out the QSA saying it is secure if you believe it is, but any competent audit would reveal that it is not secure and thus fail PCI-DSS. But yeah, it wouldn't surprise me at all if they claimed it was PCI compliant on their self assessment.
Jul
23
comment Someone borrowed my phone and Im scared its hacked
possible duplicate of If someone asks to borrow your phone to make a call, what could they do?
Jul
18
comment How to identify an encryption algorithm
If you are trying to identify an algorithm based on its actual behavior, you may want to try Cryptography.SE. I'm not sure if it is a good fit there or not, but it is more likely to fit there than here.