4,343 reputation
1226
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 8 months
seen 18 hours ago

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


May
18
comment Signing (HMAC) cookie identifier
Just to give an example, suppose the server's token generator is just a counter. If you have token 17, you can be pretty sure 16 and 18 are valid tokens, too. If an attacker needs a MAC of that token, though, then knowing that 16 is a valid token doesn't help (because the token is really 16 and HMAC(16, secret_key)).
Apr
27
comment Is browsing http sites insecure?
@Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script
Apr
22
comment Is this symetric or asymetric encryption?
Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase.
Apr
22
comment Is this symetric or asymetric encryption?
"salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions.
Apr
3
comment Is having the username and password fields on different pages more secure?
The only benefit I can think of is that it gives the user slightly longer to identify a phishing attack if the site is a fake duplicate. Closely related: Is SiteKey a valid defense against Phishing?
Apr
2
comment Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?
Where did you see the term "web bugs" used that caused confusion? The context in which you saw the phrase (or intend to use the phrase) may help to provide a good answer. "Web bugs" could mean a defect with some Web technology (a "bug" defect) or a tracking technique (e.g., you've been "bugged" by a tracking device).
Apr
2
comment Can all of Facebook's data be wiped out?
A good answer to this question would need to outline Facebook's approach to physical storage of their data (surely not a simple task and probably requires some degree of speculation), then address how to go about attacking that data storage from a variety of threat models (outside network attacker, physical infiltration, insider threat, nation state, etc.). I think this question is too broad, and needs to narrow down its assumptions about an organization's data storage (i.e., not necessarily Facebook but some organization whose storage looks like X) and narrow its threat model.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Thanks, that's very helpful clarification. If you edit your question to include all that information (link to the paper, information you already understand, formality of the answer you're looking for), it will make it a lot easier for someone to provide a good answer to your question.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
It would also be helpful to edit your question to clarify how much you already understand about homomorphic encryption. Currently, it's not clear how much background information a good answer should give.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
"We define the relaxed notion of a semi-homomorphic encryption scheme, where the plaintext can be recovered as long as the computed function does not increase the size of the input "too much"." Which part, specifically, of this definition gives you problems? The system has a homomorphism the allows a function over ciphertext, but the function will give faulty results if the output of the homomorphic function would be substantially greater than the input. Your question is not very specific. Is this the category of answer you are looking for, or do you need a more exact definition?
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Where, specifically, have you seen the term semi-homomorphic used? It's helpful to know what you've already learned about the topic.
Mar
30
comment Need some docs that say we shouldn't upper the string when saving it as a password
In what way does conversion to all-uppercase not violate the recommendation mixed-case passwords be allowed? Such a to-uppercase practice is incompatible with mixed-case passwords (since no password, as your application understands passwords, could ever have a lowercase letter).
Mar
23
comment What are you doing if you notice a MITM attack against a Linux server?
You can edit your question to be more specific: what is the function of the system being attacked? what is the potential harm of attacking this system (to customers, employees, etc.)? what are the requirements of this system (e.g. uptime)? what kinds of network resources does this server need to communicate with that are being attacked by the MITM (e.g., internal corporate resources, customer interaction)? how is the MITM attack being implemented (DNS poisoning, ARP poisoning, control of a hub), or if that's unknown, how did you detect it?
Mar
19
comment Are there additional security risks posed by rooting an Android device?
The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices?
Mar
18
comment How can Alice and Bob prove that they share a file?
Does Carl know f, or only K? Note that it's not possible to distinguish the case where both Alice and Bob have the file and the case where exactly one of them does, because they can collude to function identically. (The only restriction on Alice-Bob communication is they can't share f, but they're also prohibited from sharing f with Carl, so Carl can never exploit the one limitation in Alice-Bob communication.)
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what you envision happening on the network level when the user closes the email that lets the server know the session is over? DavidZ has captured my "I don't see how the server knows when to close the session" concerns. A session maintained between requests is useless, because there may only be one request when the user opens the email and no further request when the user closes it. You could keep the initial request alive, long-polling style, but that's exactly what I'm suggesting with the "slow load" approach.
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what kind of session you're talking about (e.g., TCP)? In particular, I don't see how the server knows when to close the session based on a navigation action in the client.
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Also, I want to look into Connection: keep-alive and see how a server could possibly track the termination of the long-lived TCP connection, even after the HTTP request completes.
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Nope, you are correct that this is 100% speculation. I emailed it to myself on Yahoo mail and didn't see any slow loading there either. I've slimmed the cruft, added an even more ridiculous theory (with caveats about how unlikely it is) and admitted the possibility that maybe this code doesn't actually do what the site says (maybe some other code used by the company does). Also, possibly time-tracking is a premium feature that doesn't apply to this tracking ID?