2,085 reputation
bio website apsillers.github.io
location United States
age 26
visits member for 2 years
seen 1 hour ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source

comment Closely spaced failed logins in auth.log
Your machine is accepting multiple simultaneous TCP connections (evidenced by the differing remote port numbers). However, per connection, it seems to be doing more than three attempts at less than a 3 second delay, which I can't explain.
comment Why isn't it possible for a third party to decrypt HTTPS traffic?
@Forivin No, because the client (in fact, anyone (!)) is able to encrypt any message in such a way that only the server can decrypt it. It doesn't matter if a bad guy gets his hands on such a message, because only the intended recipient can decrypt it. Furthermore, the client doesn't need any special knowledge to create such an encrypted message, because anyone in the world with the server's public key can do it. The server's public key is, of course, publicly available to all potential clients.
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
@AmirrezaNasiri Public-key systems are based on mathematical problems that are extremely difficult to perform in reverse. See the discrete logarithm problem for one such problem: for a = b^k mod q, it is trivial to compute a if you know b, k and q. However, it is difficult to find k, even if you know a, b, and q. The Wikipedia article has a good example and explanation.
comment Does Facebook store plain-text passwords?
Sort of a duplicate: security.stackexchange.com/questions/47840/password-security (since you ruled out a recently-entered password, most of the answers there don't quite apply perfectly, but some still do, and one of them is quite close to the top answer here)
comment Password security
@jamiescott Added your suggestion with a link to a related Secuirty.SE question.
comment Password security
@Ben That is a much better idea; done.
comment Brute Force In Order Or Random?
Assume your plaintext is in a space that can be enumerated N, N+1, N+2, ..., M. Your hash function ensures that finding H(X) for any X gives no new information about some other H(Y). Assuming in-use plaintexts fall uniformally at random within your enumerated plaintext space, then on average neither strategy (ordered or random guessing) will be any faster. The ordered approach would save you memory in an implementation, though (you store only the last guessed plaintext, rather than a full list). Note that the real world might disobey my above theoretical assumptions.
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out.
comment Why is the Access-Control-Allow-Origin header necessary?
So, if I might summarize: a browser client could act as an intermediary to help a malicious server reach some destination resource R, normally accessible to only you. Normally, we consider the case where R is protected by a cookie-based auth token system, but you present a situation in which R is protected by network topology instead. The OP's imagined browser (which always assumes A-C-A-O:*) would violate network-topology-based protection.
comment Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
@MattMcClure I actually like your edit -- you've asked a very expansive question, and I could only answer most of it. Normally (if it weren't my own answer), I'd advise posting a new answer alongside this one, but in this case I'm happy to have your edits address the components of your question that I didn't answer. Even if you linked to this comment, though, it's still likely your edit would get unfortunately rejected; would you like me to edit in your changes myself, or would you like to take a second shot at it?
comment Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?
Possible duplicate of Compute the AES-encryption key given the plaintext and its ciphertext? (The question is AES-specific, but the answers are generally sufficient to answer this generally-scoped question.)
comment Can older or custom web browsers override the same origin policy?
Could you clarify what you mean by "overhauling my site"? Are you concerned that a site will perform a cross-origin Ajax fetch of your site, overhaul the appearance, and present the altered version to the user? Or are you concerned about a large number of requests overwhelming your site? The first case is much more applicable to SOP concerns, but I now suspect the second case is closer to what you meant. (As noted below, any group of machines capable of participating in network activity could overwhelm your site.)
comment Can older or custom web browsers override the same origin policy?
@PeterStuart I initially misunderstood your threat model, and have added an additional paragraph. Assuming the SOP will protect your site is like assuming that because a person has seat belts in his car he can't get out and attack you. (The seat belt is there to protect the driver of the car, not you.)
comment Does Google's SSL encryption for searches thwart NSA spying?
Regarding your redirect-to-HTTPS comment, it's worth noting to the OP that Google uses HSTS, which eliminates the redirect entirely, after the first visit. (Of course, the first visit is still vulnerable in the way described here.)
comment What do the dots and pluses mean when OpenSSL generates keys?
I'm curious: where did you get this information? I don't doubt it's correct, but I haven't been able to find a manual page or other documentation about it. I did a Google search for "A potential prime number was generated" and found a blog that has the exact same verbatim information, so I assume it's quoted from somewhere, but I haven't found any official source (maybe source-code comments?).
comment How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
@AlfredoOsorio Ah, yes, your latest edit makes the password concern much clearer; I think I started my answer before that edit. I'll look up IEEE 802.11 rules and make an edit.
comment Get info encrypted across a MITM proxy
@EricDong From my reading of your comment, you've identified two undesirable outcomes of the SSL bad-cert warning: 1) the user ignores it or 2) the user doesn't ignore it and the communication fails. I don't think either of these problems is solvable (and certainly eliminating both in the same protocol seems quite impossible). The insolubility of problem #1 is obvious enough: users can always send data when they shouldn't (e.g., by violating the protocol!). Problem #2 is also insolvable: if an attacker can intercept a connection, they can quite easily stop communication completely.
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan Just to speak from personal experience, I've seen that error message many times when connecting to different machines that used the same dynamically-assigned IP on a local network (e.g., my SheevaPlug was yesterday, but today that address refers to my laptop), which seems to be a direct analogue to what the OP is doing here. From tthat experience I personally don't find anything suspicious, but -- having read your comment below -- I can see how your reading of the spec would make you suspect misrepresentation.
comment Is it safe to disable SSH host key checking if key-based authentication is used?
@Adnan The problem case here isn't with a new IP address. The problem is a new server accessed through a repeat IP. (For example, Amazon assigns your first VM some IP; after you destroy it, a future VM you create may be given the same IP address, but the new VM will have a new keypair.)
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Yes, but your server also has its own public key that you use to send it messages. The server stores your public key in authorized_keys to verify your identity, and you store a fingerprint of the server's public (in your laptop's ~/.ssh/known_hosts) key to verify the server. See also What is the difference between authorized_key and known_host file for SSH?