4,308 reputation
1226
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 7 months
seen 2 days ago

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script
Apr
22
comment look to crack email account password (server uses LDAP/Kerberos )
Even if you are acting ethically and legally, your question does not contain enough information to provide an answer. Do you want a full tutorial on how to do penetration testing an LDAP server? That seems like a topic for an entire book, not an answer on a Q&A site. Or are you asking about the strength of your password itself? (In that case, it's not clear why you mention LDAP for a question about password theoretics.)
Apr
22
comment Is this symetric or asymetric encryption?
Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase.
Apr
22
comment Is this symetric or asymetric encryption?
"salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions.
Apr
18
awarded  Nice Answer
Apr
14
revised Possibility to sniff HTTPS traffic on devices without installing a certificate
deleted 18 characters in body
Apr
14
awarded  Guru
Apr
3
answered Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?
Apr
3
comment Is having the username and password fields on different pages more secure?
The only benefit I can think of is that it gives the user slightly longer to identify a phishing attack if the site is a fake duplicate. Closely related: Is SiteKey a valid defense against Phishing?
Apr
2
comment Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?
Where did you see the term "web bugs" used that caused confusion? The context in which you saw the phrase (or intend to use the phrase) may help to provide a good answer. "Web bugs" could mean a defect with some Web technology (a "bug" defect) or a tracking technique (e.g., you've been "bugged" by a tracking device).
Apr
2
comment Can all of Facebook's data be wiped out?
A good answer to this question would need to outline Facebook's approach to physical storage of their data (surely not a simple task and probably requires some degree of speculation), then address how to go about attacking that data storage from a variety of threat models (outside network attacker, physical infiltration, insider threat, nation state, etc.). I think this question is too broad, and needs to narrow down its assumptions about an organization's data storage (i.e., not necessarily Facebook but some organization whose storage looks like X) and narrow its threat model.
Apr
1
awarded  Custodian
Apr
1
reviewed Approve How to prevent Fingerprinting via Font Enumeration
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Thanks, that's very helpful clarification. If you edit your question to include all that information (link to the paper, information you already understand, formality of the answer you're looking for), it will make it a lot easier for someone to provide a good answer to your question.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
It would also be helpful to edit your question to clarify how much you already understand about homomorphic encryption. Currently, it's not clear how much background information a good answer should give.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
"We define the relaxed notion of a semi-homomorphic encryption scheme, where the plaintext can be recovered as long as the computed function does not increase the size of the input "too much"." Which part, specifically, of this definition gives you problems? The system has a homomorphism the allows a function over ciphertext, but the function will give faulty results if the output of the homomorphic function would be substantially greater than the input. Your question is not very specific. Is this the category of answer you are looking for, or do you need a more exact definition?
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Where, specifically, have you seen the term semi-homomorphic used? It's helpful to know what you've already learned about the topic.
Mar
30
comment Need some docs that say we shouldn't upper the string when saving it as a password
In what way does conversion to all-uppercase not violate the recommendation mixed-case passwords be allowed? Such a to-uppercase practice is incompatible with mixed-case passwords (since no password, as your application understands passwords, could ever have a lowercase letter).
Mar
27
awarded  Nice Answer
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 60 characters in body