22,916 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 7 hours ago

Feb
19
comment Are Internet speed tests an attack vector?
A note on Speedtest.Net specifically, they use a test file that they download and then upload part of it back up I believe. The servers it connects to are also volunteered and often not hosted by SpeedTest.Net themselves.
Feb
18
comment Why doesn't Facebook use HSTS
Why would they bother to protect our information when their primary goal is to share it with others?
Feb
17
comment does any botnet/malware traffic use ssh or anything else other than TCP/IP?
If the hardware on the router doesn't report it, then there is no way to tell short of building your own device from scratch. You need a device that will report everything on the line and not pass anything along that it doesn't report. There is no way around that.
Feb
17
comment Breaking encryption with hash value of password?
@user3200534 - the easiest way would be to start the volume out with a known plain-text. When you decrypt, you could simply check if it matches. If not, then you know the key was wrong. I don't know exactly how TrueCrypt does it, but there is no reason to store a hash of a password when dealing with encryption. It would only serve to drastically weaken your security.
Feb
16
comment Is it bad to use the same sequence of characters in each password?
@Celeritas - it isn't known, but it is the first thing they will try. When user db's are cracked, they are often placed on the black market along with the user information and password details for any accounts they can figure out the passwords for. Attackers then use these lists to try and find other sites that those people have accounts on that use the same password.
Feb
15
comment How can I recover from a hacked WordPress site and prevent future attacks?
For more details on protecting your site after you clean up, check out How can I protect a WordPress installation?
Feb
15
comment How can I recover from a hacked WordPress site and prevent future attacks?
@KnightOfNi - WordPress compromises are common enough and the solution is generic enough that I think this will be helpful in the future.
Feb
14
comment Why would an attacker try to guess random email usernames on a small domain?
I guess maybe they just have more nodes than they care about or don't think as tactically as me, but if I was running a bot network, I'd want to focus on servers that have weak security and are unlikely to report or block my nodes so I can get more bang for my buck before my node gets blacklisted. If someone is blocking after 3 attempts, chances are good their security policy is decent enough to prevent the username from being used as the password. I guess I may just be giving too much credit to their intelligence though.
Feb
14
comment Why would an attacker try to guess random email usernames on a small domain?
They also are not trying different passwords or even trying the same user with more than those 4 passwords. I could understand if they were trying the same username again with different passwords but there is no repeat of the username after the IP block. I suppose it could just be a really dumb attacker though that took a very boneheaded approach that is least likely to succeed of any possible brute force attack.
Feb
14
comment Why would an attacker try to guess random email usernames on a small domain?
Wouldn't there be risk in that the behavior is easy to notice and report though, thus potentially costing them bots?
Feb
14
comment Why would an attacker try to guess random email usernames on a small domain?
SMTP, updated question with that detail as well.
Feb
14
comment Does it make sense to implement OAuth when no 3rd party is involved
Yeah, I just use OpenID's server as it is currently written, but it could be extended for a more advanced case. My needs are obviously very basic since I only have a few users and don't need any account information other than name.
Feb
14
comment Does it make sense to implement OAuth when no 3rd party is involved
You may also want to look in to OpenID. It's a bit limited, but it could work as a base starting point for you. I use that for my personal OAuth server.
Feb
14
comment Does it make sense to implement OAuth when no 3rd party is involved
The other nice thing about OAuth is you can use an existing OAuth provider potentially. There are actually pre-written OAuth account servers you could use so that you don't have to write your own.
Feb
14
comment Authenticating Users from Android with PHP Webservice
no, you shouldn't. There is more potential for error, but if properly implemented the performance and security should be similar
Feb
14
comment Authenticating Users from Android with PHP Webservice
Ah, ok. Just make sure you encrypt the entire request that you process then. The encryption is the authentication.
Feb
14
comment Authenticating Users from Android with PHP Webservice
@techno - you can do a poorman's approach by using RSA to exchange a session key and then use your own symmetric cryptography on the requests, though you will lose a lot of the advantages that things like WCF can give you.
Feb
13
comment Is the connection to Tor hidden services encrypted?
If it helps to think of it another way, TOR traffic is encrypted and a TOR service is basically a particular exit node that actually also hosts the site, so your traffic gets directed to the node that has the site running on it and is protected by TOR the whole way.
Feb
13
comment Authenticating Users from Android with PHP Webservice
@techno - why? SSL certs are based on the host name, not the IP address. Or do you mean you will need a dedicated IP? If you are using a shared host, then you need an IP address all to yourself to hook up the SSL cert to, but it can be a dynamic IP as long as it remains one that you are the only SSL user on. You can also use a self-signed certificate since you client application will know the valid thumbprint.
Feb
12
comment does any botnet/malware traffic use ssh or anything else other than TCP/IP?
SSH, FTP, TFTP etc use TCP/IP.