343 reputation
310
bio website github.com/tangrs
location
age
visits member for 2 years, 11 months
seen 7 hours ago

Jul
31
comment Is this code javascript vulnerable to DOM based XSS?
Without looking at the rest of the application, I wouldn't be so quick to say it's definitely vulnerable.
Jul
22
comment What kind of attacks do Javascript WebWorkers protect against?
I had a quick look at WebWorker and it doesn't look like a security feature? AFAIK, it's a way to implement background tasks. Possibly related: stackoverflow.com/questions/16600607/…
Jul
19
awarded  Editor
Jul
19
revised Can I connect to a network without being detected?
fixed grammar
Jul
19
suggested approved edit on Can I connect to a network without being detected?
Jun
24
awarded  Citizen Patrol
Jun
24
comment Chaining VPNs to increase privacy?
What you described sounds similar to (but not strictly the same as) the onion router Tor uses. I'm guessing the Tor network also depends on the fact that it's impractical to sub-peona the whole chain of ISPs across the globe.
May
28
comment Why use Keepass, etc. if all your passwords are in one place?
@Chloe that's certainly a risk that should be considered. Personally, I don't use LastPass for this very reason (and prefer to opt for software like 1Password). However, this is besides the point of the question which was asking whether to put all your eggs in one basket.
May
24
comment Are hashes of hashes used for password storage in practice? Why/why not?
So where would you store the GUID (since you'd need it to log back in later)?
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
Short answer: yes.
Mar
4
awarded  Notable Question
Mar
4
awarded  Good Question
Mar
3
awarded  Yearling
Mar
3
awarded  Nice Question
Mar
3
accepted How does Android L achieve strong encryption with a low entropy passphrase?
Mar
3
awarded  Popular Question
Mar
3
asked How does Android L achieve strong encryption with a low entropy passphrase?
Feb
25
comment How to perform safe authentication via HTTP?
@Aurangzeb Yes, but that someone shouldn't be everyone between you and the server. If we could trust them, we wouldn't need SSL/TLS now would we? The attack I'm talking about is the one the Tunisian government used to compromise Facebook logins by injecting Javascript into the insecure login page that sends off login details to a 3rd party before it was posted to a secure login page.
Feb
25
awarded  Commentator
Feb
25
comment How to perform safe authentication via HTTP?
What would stop a man-in-the-middle attack that serves the client a bogus version of jCryption that sends off the password to a 3rd party?