4,153 reputation
1124
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 6 months
seen 16 hours ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Mar
23
comment What are you doing if you notice a MITM attack against a Linux server?
You can edit your question to be more specific: what is the function of the system being attacked? what is the potential harm of attacking this system (to customers, employees, etc.)? what are the requirements of this system (e.g. uptime)? what kinds of network resources does this server need to communicate with that are being attacked by the MITM (e.g., internal corporate resources, customer interaction)? how is the MITM attack being implemented (DNS poisoning, ARP poisoning, control of a hub), or if that's unknown, how did you detect it?
Mar
19
comment Are there additional security risks posed by rooting an Android device?
The implications of a malicious app with root access and a vulnerable app with root access are quite similar. When vetting an app for root access, are you vetting both intent and secure coding practices?
Mar
18
comment How can Alice and Bob prove that they share a file?
Does Carl know f, or only K? Note that it's not possible to distinguish the case where both Alice and Bob have the file and the case where exactly one of them does, because they can collude to function identically. (The only restriction on Alice-Bob communication is they can't share f, but they're also prohibited from sharing f with Carl, so Carl can never exploit the one limitation in Alice-Bob communication.)
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what you envision happening on the network level when the user closes the email that lets the server know the session is over? DavidZ has captured my "I don't see how the server knows when to close the session" concerns. A session maintained between requests is useless, because there may only be one request when the user opens the email and no further request when the user closes it. You could keep the initial request alive, long-polling style, but that's exactly what I'm suggesting with the "slow load" approach.
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@KyleHale Could you clarify what kind of session you're talking about (e.g., TCP)? In particular, I don't see how the server knows when to close the session based on a navigation action in the client.
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Also, I want to look into Connection: keep-alive and see how a server could possibly track the termination of the long-lived TCP connection, even after the HTTP request completes.
Mar
13
comment Does this CSS code expose if a message is read, and how long they have been reading it?
@D.W. Nope, you are correct that this is 100% speculation. I emailed it to myself on Yahoo mail and didn't see any slow loading there either. I've slimmed the cruft, added an even more ridiculous theory (with caveats about how unlikely it is) and admitted the possibility that maybe this code doesn't actually do what the site says (maybe some other code used by the company does). Also, possibly time-tracking is a premium feature that doesn't apply to this tracking ID?
Mar
13
comment Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data?
I'll just add a question-test for the OP to this great answer: If a MITM attacker replaced your self-signed cert with an attacker-generated self-signed cert, how would you know? If your employees installed the real certificate as trusted, you'd know because the attacker's cert is not trusted. If you get a CA-signed cert, you'd know because the attacker's cert is not signed by a CA (or is signed for a different domain). If you don't do either of these things, there's no way to distinguish your real cert from any other.
Mar
3
comment What are the repercussions of a DDoS attack on a website?
For prevention: DDoS - Impossible to stop? and What techniques do advanced firewalls use to protect against DoS/DDoS? Also: How does CAPTCHA mitigate DDoS attacks?
Mar
3
comment What are the repercussions of a DDoS attack on a website?
You're asking quite a few questions here. I'm concerned that this may be too broad, but each of your individual questions (how to prevent DDoS? / how (well) do CDNs mitigate DDoS and how might they fail? / what is the scope of harm from a DDoS?) seems fine. I'd suggest limiting it to one question and asking the others separately.
Feb
27
comment Is it possible to take back the control from an MITM in progress?
I think listing defenses against every possible way an MITM attack can occur is probably too broad for a Stack Exchange answer. If you wanted to address one specific attack vector (like DNS poisoning) then that would probably be appropriately narrow. "Man in the Middle" describes a vulnerable state; the term does not imply how a system was put in that vulnerable state. Answers about practical defense measures will vary depending on the practical attack measures used to execute the attack.
Feb
27
comment Is it possible to take back the control from an MITM in progress?
There are several mechanisms that may be sufficient to mount a MITM attack: ARP poisoning, an eavesdropping ISP, DNS spoofing, etc. If you are only interested in DNS spoofing attacks, it may be helpful to make that more clear in the title and question body.
Feb
19
comment How do MACs provide authenticity?
Whats the difference between MAC vs hash is closely related, although this question appears to be asking about a specific scenario involving three parties.
Feb
16
comment At Starbucks, is my MAC address sent when I accept the terms of service for free Wifi?
In order to better answer your question: do you already understand that you have to send a MAC address to connect to any router? Also, could you clarify why you're concerned that Starbucks may be "recording all of the customers traffic"? Their router can certainly see all unencrypted traffic (that's fundamental to what a router does), but whether they record traffic is purely a matter of policy. I don't see how Starbucks policy for recording traffic (or not) has any relation to their ability to identify a user as one who has clicked through the network's terms of use or not.
Feb
16
comment Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?
Just to be clear: you're considering a case where an attacker eavesdrops on (or impersonates) email between the domain's WHOIS contact email address and the CA, yes? Based on your comment below, it seems like the two parts to your question are: (1) Does the security of SSL reduce to the security of the email communication between the domain owner and the CA? (2) If so, how secure is that, exactly?
Feb
6
comment Can someone steal cookie contents via a phishing attack?
This answer appears to address other mechanisms for stealing cookies, rather than addressing the OP's concerns about the viability of this particular attack type. (Also, it this answer will retain its value over time much better if your link to the articles you mention, rather than giving directions on how to find them. In a year from now, search Google's News tab for "internet explorer 11" may turn up completely different types of stories.)
Feb
6
comment Can someone steal cookie contents via a phishing attack?
Using document.cookie on your own site is not XSS. The site is working exactly how the attacker who built it intended. The site isn't being attacked and working differently from how its creator intended (e.g., by attacker-injected content); the site is the attack, and it's working perfectly.
Jan
4
comment Public key authentication: what gets signed?
@shimizu "[generating] a signature by the corresponding private key over the following data" means "signing the following data using the private key that corresponds to the public key being sent." As mentioned above, you don't encrypt with a private key, you sign with a private key. (Also as mentioned above, signing is generally only practical over hashes, not whole data, so you'll really just sign the hash, and send { data, Sign(Hash(data)) }. The recipient can compute Hash(data) and verify that the signature applies to data.)
Dec
31
comment Is there a secure PGP signed blogging service
While resource requests are off-topic on Stack Exchange, I think this question is probably okay if it's understood as, "What kind of scheme would make this possible, and has it been implemented anywhere?"
Dec
8
comment Why are CSRF tokens used so often?
@PaulDraper Strictly speaking, I think if you treat a lack of origin as a failed origin-match, a CSRF attack can't break your security, but your website may still break (i.e., fail to function normally for browsers that never send Origin headers) without an attack. An attack doesn't break your site; the browser's failure to send an Origin header breaks your site. That's obviously not great site design, but that's only reading of "rules that CSRF exploits can never break" I can think of that is strictly correct.