2,780 reputation
720
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 2 months
seen yesterday

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Jul
23
awarded  Necromancer
Jun
30
comment Why isn't it possible for a third party to decrypt HTTPS traffic?
@Forivin No, because the client (in fact, anyone (!)) is able to encrypt any message in such a way that only the server can decrypt it. It doesn't matter if a bad guy gets his hands on such a message, because only the intended recipient can decrypt it. Furthermore, the client doesn't need any special knowledge to create such an encrypted message, because anyone in the world with the server's public key can do it. The server's public key is, of course, publicly available to all potential clients.
May
14
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
@AmirrezaNasiri Public-key systems are based on mathematical problems that are extremely difficult to perform in reverse. See the discrete logarithm problem for one such problem: for a = b^k mod q, it is trivial to compute a if you know b, k and q. However, it is difficult to find k, even if you know a, b, and q. The Wikipedia article has a good example and explanation.
Mar
23
comment Does Facebook store plain-text passwords?
Sort of a duplicate: security.stackexchange.com/questions/47840/password-security (since you ruled out a recently-entered password, most of the answers there don't quite apply perfectly, but some still do, and one of them is quite close to the top answer here)
Jan
1
comment Password security
@jamiescott Added your suggestion with a link to a related Secuirty.SE question.
Jan
1
revised Password security
added 249 characters in body
Dec
31
comment Password security
@Ben That is a much better idea; done.
Dec
31
awarded  Nice Answer
Dec
31
revised Password security
added 28 characters in body
Dec
30
revised Password security
added 195 characters in body
Dec
30
revised Password security
added 375 characters in body
Dec
30
answered Password security
Oct
28
comment Brute Force In Order Or Random?
Assume your plaintext is in a space that can be enumerated N, N+1, N+2, ..., M. Your hash function ensures that finding H(X) for any X gives no new information about some other H(Y). Assuming in-use plaintexts fall uniformally at random within your enumerated plaintext space, then on average neither strategy (ordered or random guessing) will be any faster. The ordered approach would save you memory in an implementation, though (you store only the last guessed plaintext, rather than a full list). Note that the real world might disobey my above theoretical assumptions.
Oct
24
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out.
Oct
24
revised How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
deleted 2 characters in body
Oct
22
revised How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
added 235 characters in body
Oct
22
answered How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
Oct
18
comment Why is the Access-Control-Allow-Origin header necessary?
So, if I might summarize: a browser client could act as an intermediary to help a malicious server reach some destination resource R, normally accessible to only you. Normally, we consider the case where R is protected by a cookie-based auth token system, but you present a situation in which R is protected by network topology instead. The OP's imagined browser (which always assumes A-C-A-O:*) would violate network-topology-based protection.
Oct
17
revised Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
merged changes from Matt: http://security.stackexchange.com/review/suggested-edits/15393
Oct
17
comment Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
@MattMcClure I actually like your edit -- you've asked a very expansive question, and I could only answer most of it. Normally (if it weren't my own answer), I'd advise posting a new answer alongside this one, but in this case I'm happy to have your edits address the components of your question that I didn't answer. Even if you linked to this comment, though, it's still likely your edit would get unfortunately rejected; would you like me to edit in your changes myself, or would you like to take a second shot at it?