3,085 reputation
721
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 3 months
seen 22 hours ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Dec
30
answered Password security
Oct
28
comment Brute Force In Order Or Random?
Assume your plaintext is in a space that can be enumerated N, N+1, N+2, ..., M. Your hash function ensures that finding H(X) for any X gives no new information about some other H(Y). Assuming in-use plaintexts fall uniformally at random within your enumerated plaintext space, then on average neither strategy (ordered or random guessing) will be any faster. The ordered approach would save you memory in an implementation, though (you store only the last guessed plaintext, rather than a full list). Note that the real world might disobey my above theoretical assumptions.
Oct
24
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out.
Oct
24
revised How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
deleted 2 characters in body
Oct
22
revised How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
added 235 characters in body
Oct
22
answered How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
Oct
18
comment Why is the Access-Control-Allow-Origin header necessary?
So, if I might summarize: a browser client could act as an intermediary to help a malicious server reach some destination resource R, normally accessible to only you. Normally, we consider the case where R is protected by a cookie-based auth token system, but you present a situation in which R is protected by network topology instead. The OP's imagined browser (which always assumes A-C-A-O:*) would violate network-topology-based protection.
Oct
17
revised Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
merged changes from Matt: http://security.stackexchange.com/review/suggested-edits/15393
Oct
17
comment Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
@MattMcClure I actually like your edit -- you've asked a very expansive question, and I could only answer most of it. Normally (if it weren't my own answer), I'd advise posting a new answer alongside this one, but in this case I'm happy to have your edits address the components of your question that I didn't answer. Even if you linked to this comment, though, it's still likely your edit would get unfortunately rejected; would you like me to edit in your changes myself, or would you like to take a second shot at it?
Oct
16
revised Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
added 468 characters in body
Oct
16
answered Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
Oct
2
comment Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?
Possible duplicate of Compute the AES-encryption key given the plaintext and its ciphertext? (The question is AES-specific, but the answers are generally sufficient to answer this generally-scoped question.)
Oct
1
revised Can older or custom web browsers override the same origin policy?
added 117 characters in body
Oct
1
revised Can older or custom web browsers override the same origin policy?
added 117 characters in body
Oct
1
comment Can older or custom web browsers override the same origin policy?
Could you clarify what you mean by "overhauling my site"? Are you concerned that a site will perform a cross-origin Ajax fetch of your site, overhaul the appearance, and present the altered version to the user? Or are you concerned about a large number of requests overwhelming your site? The first case is much more applicable to SOP concerns, but I now suspect the second case is closer to what you meant. (As noted below, any group of machines capable of participating in network activity could overwhelm your site.)
Oct
1
comment Can older or custom web browsers override the same origin policy?
@PeterStuart I initially misunderstood your threat model, and have added an additional paragraph. Assuming the SOP will protect your site is like assuming that because a person has seat belts in his car he can't get out and attack you. (The seat belt is there to protect the driver of the car, not you.)
Oct
1
revised Can older or custom web browsers override the same origin policy?
added 555 characters in body
Oct
1
answered Can older or custom web browsers override the same origin policy?
Sep
30
answered Does Google's SSL encryption for searches thwart NSA spying?
Sep
30
comment Does Google's SSL encryption for searches thwart NSA spying?
Regarding your redirect-to-HTTPS comment, it's worth noting to the OP that Google uses HSTS, which eliminates the redirect entirely, after the first visit. (Of course, the first visit is still vulnerable in the way described here.)