Reputation
4,510
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 27
Newest
 Guru
Impact
~157k people reached

  • 0 posts edited
  • 13 helpful flags
  • 201 votes cast
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Where, specifically, have you seen the term semi-homomorphic used? It's helpful to know what you've already learned about the topic.
Mar
30
comment Need some docs that say we shouldn't upper the string when saving it as a password
In what way does conversion to all-uppercase not violate the recommendation mixed-case passwords be allowed? Such a to-uppercase practice is incompatible with mixed-case passwords (since no password, as your application understands passwords, could ever have a lowercase letter).
Mar
27
awarded  Nice Answer
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 60 characters in body
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
deleted 7 characters in body
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 176 characters in body
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 176 characters in body
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 2 characters in body
Mar
27
answered Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
Mar
23
comment What are you doing if you notice a MITM attack against a Linux server?
You can edit your question to be more specific: what is the function of the system being attacked? what is the potential harm of attacking this system (to customers, employees, etc.)? what are the requirements of this system (e.g. uptime)? what kinds of network resources does this server need to communicate with that are being attacked by the MITM (e.g., internal corporate resources, customer interaction)? how is the MITM attack being implemented (DNS poisoning, ARP poisoning, control of a hub), or if that's unknown, how did you detect it?
Mar
19
comment Are there additional security risks posed by rooting an Android device?
The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices?
Mar
18
comment How can Alice and Bob prove that they share a file?
Does Carl know f, or only K? Note that it's not possible to distinguish the case where both Alice and Bob have the file and the case where exactly one of them does, because they can collude to function identically. (The only restriction on Alice-Bob communication is they can't share f, but they're also prohibited from sharing f with Carl, so Carl can never exploit the one limitation in Alice-Bob communication.)
Mar
14
awarded  Good Answer
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what you envision happening on the network level when the user closes the email that lets the server know the session is over? DavidZ has captured my "I don't see how the server knows when to close the session" concerns. A session maintained between requests is useless, because there may only be one request when the user opens the email and no further request when the user closes it. You could keep the initial request alive, long-polling style, but that's exactly what I'm suggesting with the "slow load" approach.
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what kind of session you're talking about (e.g., TCP)? In particular, I don't see how the server knows when to close the session based on a navigation action in the client.
Mar
14
revised Does this CSS code expose if a message is read, and how long they have been reading it?
added 203 characters in body
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Also, I want to look into Connection: keep-alive and see how a server could possibly track the termination of the long-lived TCP connection, even after the HTTP request completes.
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
deleted 27 characters in body
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Nope, you are correct that this is 100% speculation. I emailed it to myself on Yahoo mail and didn't see any slow loading there either. I've slimmed the cruft, added an even more ridiculous theory (with caveats about how unlikely it is) and admitted the possibility that maybe this code doesn't actually do what the site says (maybe some other code used by the company does). Also, possibly time-tracking is a premium feature that doesn't apply to this tracking ID?
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
deleted 27 characters in body