2,036 reputation
516
bio website github.com/apsillers
location United States
age 26
visits member for 1 year, 10 months
seen 2 days ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Jul
15
comment Intercepting and reading SSL traffic generated by Android
@QuentinSwain has the right idea, but there technical obstacles to actually doing it in older Android systems (i.e., pre-4.0). See SO's How to install trusted CA certificate on Android device?, which links to an article that links to Android's bug tracker item "Provide support for managing CA and client certificates" which states it was added in ICS (4.0). Before 4.0, custom CAs were only used for VPN and Wifi, not websites or apps. (It may be possible on pre-4.0 with a rooted device.)
Jul
15
comment How to protect against “padding oracle attacks.”
Relevant: Crypto.SE's How does a padding oracle attack work? (Note that that Q&A does not address the "what should I do about it in PHP?" component of your question.)
Jul
13
awarded  Nice Answer
Jul
12
comment Should a site have SSL if it doesn't have a login form?
"I don't see this as being your problem." -- You don't think it's their problem if they miss out on potential hires? Or think that those items you listed simply won't happen regardless of whether that can (e.g., because the company is too small of a target)? Or do you mean something else?
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 4 characters in body
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 1015 characters in body
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 94 characters in body
Jul
12
revised Should a site have SSL if it doesn't have a login form?
added 94 characters in body
Jul
12
answered Should a site have SSL if it doesn't have a login form?
Jul
12
comment Should a site have SSL if it doesn't have a login form?
Do your job application forms not require any personal information?
Jul
11
comment Taking password letters not whole one, is this secure?
@BlackFire27 There's a great writeup of why MD5 is inferior for password hashing at How to securely hash passwords?
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
A CA breach that resulted in the issuance of fake Google certs: en.m.wikipedia.org/wiki/DigiNotar
Jun
27
comment How can I protect myself from Evercookies?
Some helpful reading: bugzilla.mozilla.org/show_bug.cgi?id=598925, bugzilla.mozilla.org/show_bug.cgi?id=598678, github.com/samyk/evercookie/issues/19, securityweek.com/nevercookie-eats-evercookie-new-firefox-plugin
Jun
26
revised In what way is a partially encrypted webpage insecure?
added 188 characters in body
Jun
26
revised In what way is a partially encrypted webpage insecure?
added 120 characters in body
Jun
26
answered In what way is a partially encrypted webpage insecure?
Jun
21
comment Google Chrome & Spear-phishing
I would assume indicators might include hotlinked images from a legitimate site, along with input forms and perhaps the presence of particular natural language phrases like "your account will be deactivated unless you..." Also, perhaps detecting identical clones of known high-value login pages. That's just a guess of possible approaches -- I'm also very interested in a canonical answer, if one is publicly available.
Jun
19
awarded  Nice Answer
Jun
17
revised How can I encrypt my router admin page login session?
added 218 characters in body
Jun
17
revised How can I encrypt my router admin page login session?
added 3 characters in body