2,305 reputation
617
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 1 month
seen 5 hours ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Jul
23
revised How to know if mail is for tracking our IP
added 1004 characters in body
Jul
23
answered How to know if mail is for tracking our IP
Jul
22
comment Eye-Tracking, Public Access Points and Password Protection
@Elmer There might possibly be a delay in your ability to accept answers because you are a new user; if so, I would expect to see the option very soon (in the form of a gray clickable checkmark). See also How does accepting an answer work?
Jul
19
revised Is using a numbers station to transmit a one-time-pad as key actually insecure?
added 3 characters in body
Jul
19
revised Is using a numbers station to transmit a one-time-pad as key actually insecure?
added 375 characters in body
Jul
19
answered Is using a numbers station to transmit a one-time-pad as key actually insecure?
Jul
18
comment Fake Websites: How to avoid?
When SSL is used, an extended validation certificate will have information about the organization that runs the site: e.g., while a regular cert might say "this is the real facebook.com," an extended cert will say "this is the real facebook.com, run by the Facebook, Inc. company." Of course, you can't use this to validate an attack site that doesn't have use extended validation cert, so it's not too helpful here.
Jul
18
comment Securing JSON? Is it justifiable to return html code instead of json to prevent copy cat?
+1; also ask your local lawyer about "database rights": "A database right is considered to be a property right, comparable to but distinct from copyright, that exists to recognise the investment that is made in compiling a database..." (YMMV by national jurisdiction.)
Jul
18
comment Am I covered with GPL If I want to share open source code of project developed in my company?
Noteworthy: this was already asked on Programmers, nearly verbatim, by a different user.
Jul
17
comment How to show XSS popup without using alert and script keywords?
What if you segment the function name as concatenated strings in bracket notation, e.g., onerror="window['al'+'ert'](1)"? (The strings could optionally be stored in variables.) Or is the alert function itself somehow disabled or overwritten? (In that case, delete window['al'+'ert'] should restore it in most browsers.)
Jul
17
revised Can I avoid DNS spoofing by typing the IP address?
added 50 characters in body
Jul
17
answered Can I avoid DNS spoofing by typing the IP address?
Jul
15
comment Stealing WiFi Internet connection
Not an answer, but: if you are correct, and someone has accessed your wireless router even with a password set up, that person is probably also smart enough to spoof his MAC (so item 2.1.a is an overwhelming "no" -- even if it were possible to trace a MAC back to a purchaser somehow, you likely are not seeing the device's real MAC). In the event I'm wrong, see coffer.com/mac_find to look up the MAC's vendor.
Jul
15
comment Intercepting and reading SSL traffic generated by Android
@AJHenderson Sure, I just wanted to bring up the shortcomings of pre-4.0 custom CAs to save the OP some hair-pulling frustration, in case he was planning to use a pre-4.0 device for testing.
Jul
15
comment Intercepting and reading SSL traffic generated by Android
@QuentinSwain has the right idea, but there technical obstacles to actually doing it in older Android systems (i.e., pre-4.0). See SO's How to install trusted CA certificate on Android device?, which links to an article that links to Android's bug tracker item "Provide support for managing CA and client certificates" which states it was added in ICS (4.0). Before 4.0, custom CAs were only used for VPN and Wifi, not websites or apps. (It may be possible on pre-4.0 with a rooted device.)
Jul
15
comment How to protect against “padding oracle attacks.”
Relevant: Crypto.SE's How does a padding oracle attack work? (Note that that Q&A does not address the "what should I do about it in PHP?" component of your question.)
Jul
13
awarded  Nice Answer
Jul
12
comment Should a site have SSL if it doesn't have a login form?
"I don't see this as being your problem." -- You don't think it's their problem if they miss out on potential hires? Or think that those items you listed simply won't happen regardless of whether that can (e.g., because the company is too small of a target)? Or do you mean something else?
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 4 characters in body
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 1015 characters in body