3,085 reputation
721
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 3 months
seen 2 days ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Sep
17
awarded  Yearling
Sep
9
comment What do the dots and pluses mean when OpenSSL generates keys?
I'm curious: where did you get this information? I don't doubt it's correct, but I haven't been able to find a manual page or other documentation about it. I did a Google search for "A potential prime number was generated" and found a blog that has the exact same verbatim information, so I assume it's quoted from somewhere, but I haven't found any official source (maybe source-code comments?).
Aug
20
revised How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
added 333 characters in body
Aug
20
awarded  Disciplined
Aug
20
comment How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
@AlfredoOsorio Ah, yes, your latest edit makes the password concern much clearer; I think I started my answer before that edit. I'll look up IEEE 802.11 rules and make an edit.
Aug
20
revised How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
added 130 characters in body
Aug
20
answered How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
Aug
12
awarded  Autobiographer
Aug
6
awarded  Enthusiast
Aug
5
comment Get info encrypted across a MITM proxy
@EricDong From my reading of your comment, you've identified two undesirable outcomes of the SSL bad-cert warning: 1) the user ignores it or 2) the user doesn't ignore it and the communication fails. I don't think either of these problems is solvable (and certainly eliminating both in the same protocol seems quite impossible). The insolubility of problem #1 is obvious enough: users can always send data when they shouldn't (e.g., by violating the protocol!). Problem #2 is also insolvable: if an attacker can intercept a connection, they can quite easily stop communication completely.
Aug
5
awarded  Nice Answer
Aug
4
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan Just to speak from personal experience, I've seen that error message many times when connecting to different machines that used the same dynamically-assigned IP on a local network (e.g., my SheevaPlug was 192.168.1.101 yesterday, but today that address refers to my laptop), which seems to be a direct analogue to what the OP is doing here. From tthat experience I personally don't find anything suspicious, but -- having read your comment below -- I can see how your reading of the spec would make you suspect misrepresentation.
Aug
3
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan The problem case here isn't with a new IP address. The problem is a new server accessed through a repeat IP. (For example, Amazon assigns your first VM some IP; after you destroy it, a future VM you create may be given the same IP address, but the new VM will have a new keypair.)
Jul
27
revised Encryption algorithm encryptable by md5 of key and decryptable by key
added 492 characters in body
Jul
27
answered Encryption algorithm encryptable by md5 of key and decryptable by key
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Yes, but your server also has its own public key that you use to send it messages. The server stores your public key in authorized_keys to verify your identity, and you store a fingerprint of the server's public (in your laptop's ~/.ssh/known_hosts) key to verify the server. See also What is the difference between authorized_key and known_host file for SSH?
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Yes, correct -- that is the entire point of encryption. You can freely distribute your public key (that's why it's called a public key). The public key only allows someone to send messages to you (not as you, nor as anyone else).
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
If GOOD doesn't have a keypair, then A can't send encrypted messages to GOOD. In an asymmetric key system, the recipient of encrypted messages must have a private key (and then senders use the associated public key to send messages). A's public key is used for encrypting messages intended for A (i.e., to be decrypted by A's private key). To have two-way communication and authentication, you need a keypair for each party.
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
When A connects to GOOD, he uses GOOD's public key to encrypt his messages to GOOD. If BAD intercepts encrypted message intended for GOOD, BAD can't read them, because of the encryption. Assuming A already knows GOOD's public key, he will not use BAD's public key by mistake when trying to talk to GOOD (or if he does, the system will give him a stern warning that it's a bad idea). Thus, A's outgoing messages will be encrypted with GOOD's public key, and messages from GOOD to A are encrypted with A's public key.
Jul
26
revised In which ways could a javascript making a cross domain HEAD request be a threat?
added 413 characters in body