Reputation
4,788
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 28
Newest
 Caucus
Impact
~130k people reached

  • 0 posts edited
  • 13 helpful flags
  • 195 votes cast
Mar
27
revised Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
added 2 characters in body
Mar
27
answered Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”
Mar
23
comment What are you doing if you notice a MITM attack against a Linux server?
You can edit your question to be more specific: what is the function of the system being attacked? what is the potential harm of attacking this system (to customers, employees, etc.)? what are the requirements of this system (e.g. uptime)? what kinds of network resources does this server need to communicate with that are being attacked by the MITM (e.g., internal corporate resources, customer interaction)? how is the MITM attack being implemented (DNS poisoning, ARP poisoning, control of a hub), or if that's unknown, how did you detect it?
Mar
19
comment Are there additional security risks posed by rooting an Android device?
The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices?
Mar
18
comment How can Alice and Bob prove that they share a file?
Does Carl know f, or only K? Note that it's not possible to distinguish the case where both Alice and Bob have the file and the case where exactly one of them does, because they can collude to function identically. (The only restriction on Alice-Bob communication is they can't share f, but they're also prohibited from sharing f with Carl, so Carl can never exploit the one limitation in Alice-Bob communication.)
Mar
14
awarded  Good Answer
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what you envision happening on the network level when the user closes the email that lets the server know the session is over? DavidZ has captured my "I don't see how the server knows when to close the session" concerns. A session maintained between requests is useless, because there may only be one request when the user opens the email and no further request when the user closes it. You could keep the initial request alive, long-polling style, but that's exactly what I'm suggesting with the "slow load" approach.
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what kind of session you're talking about (e.g., TCP)? In particular, I don't see how the server knows when to close the session based on a navigation action in the client.
Mar
14
revised Does this CSS code expose if a message is read, and how long they have been reading it?
added 203 characters in body
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Also, I want to look into Connection: keep-alive and see how a server could possibly track the termination of the long-lived TCP connection, even after the HTTP request completes.
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
deleted 27 characters in body
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Nope, you are correct that this is 100% speculation. I emailed it to myself on Yahoo mail and didn't see any slow loading there either. I've slimmed the cruft, added an even more ridiculous theory (with caveats about how unlikely it is) and admitted the possibility that maybe this code doesn't actually do what the site says (maybe some other code used by the company does). Also, possibly time-tracking is a premium feature that doesn't apply to this tracking ID?
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
deleted 27 characters in body
Mar
13
awarded  Nice Answer
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
added 2 characters in body
Mar
13
revised Does this CSS code expose if a message is read, and how long they have been reading it?
added 123 characters in body
Mar
13
answered Does this CSS code expose if a message is read, and how long they have been reading it?
Mar
13
comment Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?
I'll just add a question-test for the OP to this great answer: If a MITM attacker replaced your self-signed cert with an attacker-generated self-signed cert, how would you know? If your employees installed the real certificate as trusted, you'd know because the attacker's cert is not trusted. If you get a CA-signed cert, you'd know because the attacker's cert is not signed by a CA (or is signed for a different domain). If you don't do either of these things, there's no way to distinguish your real cert from any other.
Mar
5
awarded  Good Answer
Mar
5
revised Possibility to sniff HTTPS traffic on devices without installing a certificate
added 184 characters in body