343 reputation
310
bio website github.com/tangrs
location
age
visits member for 2 years, 11 months
seen 17 hours ago

Jul
22
comment What kind of attacks do Javascript WebWorkers protect against?
I had a quick look at WebWorker and it doesn't look like a security feature? AFAIK, it's a way to implement background tasks. Possibly related: stackoverflow.com/questions/16600607/…
Jun
24
comment Chaining VPNs to increase privacy?
What you described sounds similar to (but not strictly the same as) the onion router Tor uses. I'm guessing the Tor network also depends on the fact that it's impractical to sub-peona the whole chain of ISPs across the globe.
May
28
comment Why use Keepass, etc. if all your passwords are in one place?
@Chloe that's certainly a risk that should be considered. Personally, I don't use LastPass for this very reason (and prefer to opt for software like 1Password). However, this is besides the point of the question which was asking whether to put all your eggs in one basket.
May
24
comment Are hashes of hashes used for password storage in practice? Why/why not?
So where would you store the GUID (since you'd need it to log back in later)?
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
Short answer: yes.
Feb
25
comment How to perform safe authentication via HTTP?
@Aurangzeb Yes, but that someone shouldn't be everyone between you and the server. If we could trust them, we wouldn't need SSL/TLS now would we? The attack I'm talking about is the one the Tunisian government used to compromise Facebook logins by injecting Javascript into the insecure login page that sends off login details to a 3rd party before it was posted to a secure login page.
Feb
25
comment How to perform safe authentication via HTTP?
What would stop a man-in-the-middle attack that serves the client a bogus version of jCryption that sends off the password to a 3rd party?
Jan
8
comment Is it possible to hide behind a hostname to purposefully effect SEO?
Whoa, slow down. What problem are you exactly facing? What makes you think Google has penalised you? cum hoc ergo propter hoc
Dec
3
comment What is the shortest malicious XSS possible?
This sounds perfect for the Code Golf SE
Nov
11
comment JavaScript Injection using Man in the Middle Attack
Download a copy of MITM Proxy and have a play around. Modifying traffic is done on-the-fly.
Oct
25
comment Protecting a document that you sell
Without this turning into an anti-DRM argument, the only real way of preventing piracy is to make buying the document or book more appealing than pirating it in my opinion. If you do decide to go with rolling your own DRM, keep in mind that you're probably going to end up doing 80% of the work preventing 20% of your readers from pirating.
Oct
25
comment Wifi Educational Hacking - Aircrack-ng wpa vs wpa-psk
There is no upper limit. If the password is chosen properly, you'll practically never find it (given no implementation or cryptographic flaws). Furthermore, I don't think I've read anything that suggests that any part of WPA2 is vulnerable to a birthday attack or even that the birthday attack is applicable here (it seems to be only used to find collisions in hashes and digital signatures).
Oct
11
comment My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?
I wonder if Bozocrack would work well here...
Jul
11
comment Any example where client certification is required?
I believe startssl does this to authenticate its users
May
24
comment Why use Keepass, etc. if all your passwords are in one place?
LassPass does claim that your passwords are encrypted and decrypted locally and the key isn't ever sent to the server so it's probably on the same level as putting an encrypted keychain online.