Reputation
4,510
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 27
Newest
 Guru
Impact
~157k people reached

  • 0 posts edited
  • 13 helpful flags
  • 201 votes cast
Feb
6
comment Can someone steal cookie contents via a phishing attack?
This answer appears to address other mechanisms for stealing cookies, rather than addressing the OP's concerns about the viability of this particular attack type. (Also, it this answer will retain its value over time much better if your link to the articles you mention, rather than giving directions on how to find them. In a year from now, search Google's News tab for "internet explorer 11" may turn up completely different types of stories.)
Feb
6
comment Can someone steal cookie contents via a phishing attack?
Using document.cookie on your own site is not XSS. The site is working exactly how the attacker who built it intended. The site isn't being attacked and working differently from how its creator intended (e.g., by attacker-injected content); the site is the attack, and it's working perfectly.
Feb
6
revised Can someone steal cookie contents via a phishing attack?
added 36 characters in body
Feb
6
revised Can someone steal cookie contents via a phishing attack?
added 383 characters in body
Feb
6
answered Can someone steal cookie contents via a phishing attack?
Jan
20
awarded  Good Answer
Jan
4
comment Public key authentication: what gets signed?
@shimizu "[generating] a signature by the corresponding private key over the following data" means "signing the following data using the private key that corresponds to the public key being sent." As mentioned above, you don't encrypt with a private key, you sign with a private key. (Also as mentioned above, signing is generally only practical over hashes, not whole data, so you'll really just sign the hash, and send { data, Sign(Hash(data)) }. The recipient can compute Hash(data) and verify that the signature applies to data.)
Dec
31
revised Public key authentication: what gets signed?
added 165 characters in body
Dec
31
answered Public key authentication: what gets signed?
Dec
31
comment Is there a secure PGP signed blogging service
While resource requests are off-topic on Stack Exchange, I think this question is probably okay if it's understood as, "What kind of scheme would make this possible, and has it been implemented anywhere?"
Dec
23
revised What are the dangers of allowing “less secure apps” to access my Google account?
added 170 characters in body
Dec
18
awarded  Nice Answer
Dec
17
revised Why not use symmetric encryption?
added 98 characters in body
Dec
17
revised Why not use symmetric encryption?
added 22 characters in body
Dec
17
answered Why not use symmetric encryption?
Dec
8
revised Long passwords and key derivation functions
added 427 characters in body
Dec
8
answered Long passwords and key derivation functions
Dec
8
comment Why are CSRF tokens used so often?
@PaulDraper Strictly speaking, I think if you treat a lack of origin as a failed origin-match, a CSRF attack can't break your security, but your website may still break (i.e., fail to function normally for browsers that never send Origin headers) without an attack. An attack doesn't break your site; the browser's failure to send an Origin header breaks your site. That's obviously not great site design, but that's only reading of "rules that CSRF exploits can never break" I can think of that is strictly correct.
Dec
1
comment MITM faking certificates
"what will [the server] check to ensure I am a legitimate 3DS?" By definition, if the 3DS doesn't use TLS mutual authentication, the server does not validate the client. If the server does validate the identity of the client, then you are using mutual authentication. Without mutual authn, it's still possible to make the messages only usable by a 3DS by, e.g., transmitting messages in a proprietary binary format, or only transmitting encrypted data, decrypted by a secret decryption key printed into the 3DS hardware.
Dec
1
comment MITM faking certificates
"the Nintendo server is expecting to see the original 3DS public certificate" Does the 3DS connection use mutual authentication? If not, the server's public key is public, and the server normally should give it to you (assuming you're using TLS; maybe you're not?).