4,738 reputation
1328
bio website apsillers.github.io
location United States
age 27
visits member for 2 years, 10 months
seen 3 hours ago

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


Mar
4
awarded  Nice Answer
Mar
4
revised Possibility to sniff HTTPS traffic on devices without installing a certificate
added 387 characters in body
Mar
4
answered Possibility to sniff HTTPS traffic on devices without installing a certificate
Mar
3
comment What are the repercussions of a DDoS attack on a website?
For prevention: DDoS - Impossible to stop? and What techniques do advanced firewalls use to protect against DoS/DDoS? Also: How does CAPTCHA mitigate DDoS attacks?
Mar
3
comment What are the repercussions of a DDoS attack on a website?
You're asking quite a few questions here. I'm concerned that this may be too broad, but each of your individual questions (how to prevent DDoS? / how (well) do CDNs mitigate DDoS and how might they fail? / what is the scope of harm from a DDoS?) seems fine. I'd suggest limiting it to one question and asking the others separately.
Feb
27
comment Is it possible to take back the control from an MITM in progress?
I think listing defenses against every possible way an MITM attack can occur is probably too broad for a Stack Exchange answer. If you wanted to address one specific attack vector (like DNS poisoning) then that would probably be appropriately narrow. "Man in the Middle" describes a vulnerable state; the term does not imply how a system was put in that vulnerable state. Answers about practical defense measures will vary depending on the practical attack measures used to execute the attack.
Feb
27
comment Is it possible to take back the control from an MITM in progress?
There are several mechanisms that may be sufficient to mount a MITM attack: ARP poisoning, an eavesdropping ISP, DNS spoofing, etc. If you are only interested in DNS spoofing attacks, it may be helpful to make that more clear in the title and question body.
Feb
23
answered is encrypted body http secure
Feb
19
comment How do MACs provide authenticity?
Whats the difference between MAC vs hash is closely related, although this question appears to be asking about a specific scenario involving three parties.
Feb
19
awarded  Necromancer
Feb
16
comment At Starbucks, is my MAC address sent when I accept the terms of service for free Wifi?
In order to better answer your question: do you already understand that you have to send a MAC address to connect to any router? Also, could you clarify why you're concerned that Starbucks may be "recording all of the customers traffic"? Their router can certainly see all unencrypted traffic (that's fundamental to what a router does), but whether they record traffic is purely a matter of policy. I don't see how Starbucks policy for recording traffic (or not) has any relation to their ability to identify a user as one who has clicked through the network's terms of use or not.
Feb
16
comment Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?
Just to be clear: you're considering a case where an attacker eavesdrops on (or impersonates) email between the domain's WHOIS contact email address and the CA, yes? Based on your comment below, it seems like the two parts to your question are: (1) Does the security of SSL reduce to the security of the email communication between the domain owner and the CA? (2) If so, how secure is that, exactly?
Feb
7
revised Can someone steal cookie contents via a phishing attack?
added 353 characters in body
Feb
6
comment Can someone steal cookie contents via a phishing attack?
This answer appears to address other mechanisms for stealing cookies, rather than addressing the OP's concerns about the viability of this particular attack type. (Also, it this answer will retain its value over time much better if your link to the articles you mention, rather than giving directions on how to find them. In a year from now, search Google's News tab for "internet explorer 11" may turn up completely different types of stories.)
Feb
6
comment Can someone steal cookie contents via a phishing attack?
Using document.cookie on your own site is not XSS. The site is working exactly how the attacker who built it intended. The site isn't being attacked and working differently from how its creator intended (e.g., by attacker-injected content); the site is the attack, and it's working perfectly.
Feb
6
revised Can someone steal cookie contents via a phishing attack?
added 36 characters in body
Feb
6
revised Can someone steal cookie contents via a phishing attack?
added 383 characters in body
Feb
6
answered Can someone steal cookie contents via a phishing attack?
Jan
20
awarded  Good Answer
Jan
4
comment Public key authentication: what gets signed?
@shimizu "[generating] a signature by the corresponding private key over the following data" means "signing the following data using the private key that corresponds to the public key being sent." As mentioned above, you don't encrypt with a private key, you sign with a private key. (Also as mentioned above, signing is generally only practical over hashes, not whole data, so you'll really just sign the hash, and send { data, Sign(Hash(data)) }. The recipient can compute Hash(data) and verify that the signature applies to data.)