3,095 reputation
721
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 3 months
seen 6 hours ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Dec
18
awarded  Nice Answer
Dec
17
revised Why not use symmetric encryption?
added 98 characters in body
Dec
17
revised Why not use symmetric encryption?
added 22 characters in body
Dec
17
answered Why not use symmetric encryption?
Dec
8
revised Long passwords and key derivation functions
added 427 characters in body
Dec
8
answered Long passwords and key derivation functions
Dec
8
comment Why are CSRF tokens used so often?
@PaulDraper Strictly speaking, I think if you treat a lack of origin as a failed origin-match, a CSRF attack can't break your security, but your website may still break (i.e., fail to function normally for browsers that never send Origin headers) without an attack. An attack doesn't break your site; the browser's failure to send an Origin header breaks your site. That's obviously not great site design, but that's only reading of "rules that CSRF exploits can never break" I can think of that is strictly correct.
Dec
1
comment MITM faking certificates
"what will [the server] check to ensure I am a legitimate 3DS?" By definition, if the 3DS doesn't use TLS mutual authentication, the server does not validate the client. If the server does validate the identity of the client, then you are using mutual authentication. Without mutual authn, it's still possible to make the messages only usable by a 3DS by, e.g., transmitting messages in a proprietary binary format, or only transmitting encrypted data, decrypted by a secret decryption key printed into the 3DS hardware.
Dec
1
comment MITM faking certificates
"the Nintendo server is expecting to see the original 3DS public certificate" Does the 3DS connection use mutual authentication? If not, the server's public key is public, and the server normally should give it to you (assuming you're using TLS; maybe you're not?).
Nov
16
awarded  Revival
Nov
11
comment How to be sure that downloaded file is correct?
@nikitablack Sure, a malware author could sign a virus with any private signing certificate that he has. The benefit of a signature is knowing who signed it. If you download a file from "Good Guys, Inc." but the file is signed by "Mysterious Suspicious Corp.", you know the file didn't come from Good Guys, Inc. It seems pretty dumb to sign your malware, though: after a few reports, Windows (or the CA) will send around an update not to open files signed by Mysterious Corp. (Of course, if someone steals the private signing key from Good Guys, Inc., that's an entirely different matter...)
Nov
11
awarded  Good Answer
Nov
10
awarded  Mortarboard
Nov
10
revised How to be sure that downloaded file is correct?
added 43 characters in body
Nov
10
answered How to be sure that downloaded file is correct?
Nov
10
awarded  Nice Answer
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited to add one final attempt at explanation, where we consider a single flipped bit, changed by honest mistake by the ISP.
Nov
10
revised JavaScript Injection using Man in the Middle Attack
added 799 characters in body
Nov
10
revised JavaScript Injection using Man in the Middle Attack
deleted 1 character in body
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious Injection is done at the network layer, with possibly some changes to the application layer (e.g., modifying the Content-Length header to reflect the length of the modified document).