2,780 reputation
720
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 2 months
seen 6 hours ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Nov
11
comment How to be sure that downloaded file is correct?
@nikitablack Sure, a malware author could sign a virus with any private signing certificate that he has. The benefit of a signature is knowing who signed it. If you download a file from "Good Guys, Inc." but the file is signed by "Mysterious Suspicious Corp.", you know the file didn't come from Good Guys, Inc. It seems pretty dumb to sign your malware, though: after a few reports, Windows (or the CA) will send around an update not to open files signed by Mysterious Corp. (Of course, if someone steals the private signing key from Good Guys, Inc., that's an entirely different matter...)
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited to add one final attempt at explanation, where we consider a single flipped bit, changed by honest mistake by the ISP.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious Injection is done at the network layer, with possibly some changes to the application layer (e.g., modifying the Content-Length header to reflect the length of the modified document).
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious I've edited my based on your comments. I think you believe that a modification requires some kind of HTTP redirect. This is not correct.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
@Curious "Because the html file is already received.." -- we perform the modification on the HTML resource before the HTML resource is received. The ISP can modify any non-HTTPS traffic: HTML, JS, CSS, office documents, binary executable, etc., etc. There's no difference between modifying a JS file and modifying an HTML file. I don't entirely understand why you're treating the cases of a JS file and an HTML file differently. They're all insecure resources being processed by the ISP.
Nov
10
comment JavaScript Injection using Man in the Middle Attack
If the HTML page is protected by HTTPS, no. If the HTML page is not protected by HTTPS, yes. If the HTML page is not protected by HTTPS, the ISP can directly change anything about the page and can sniff credentials directly off the wire as in my first diagram. (If the log-in page is unsecured, but sends the credentials through a secure unsniffable channel, it's trivial to change the behavior of the unsecured page to use an insecure channel instead.)
Sep
26
comment How is a cypher algorithm verified?
Maybe a duplicate: What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms? "Why can't they prove any of their algorithms secure? ...there are fundamental reasons that make it very difficult to prove that an encryption algorithm is secure... proving that an algorithm like AES or RSA or SHA256 is secure seems likely to be at least as hard as proving that P != NP"
Sep
25
comment GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?
Anything your bash shell can do, an exploit that controls your bash shell can do. Can your bash shell do anything besides manipulate your repositories? (Note, however, that your chance of attack is may be reduced, because nothing else uses your bash shell. My understanding is that, in *nix, this is a huge problem because lots of other software depends on bash and environment variables. In Windows, it's less likely that any other software is set up to invoke your vulnerable bash shell.)
Sep
23
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Regarding your "password" approach, this is exactly how API keys work. However, that will only uniquely identify the user; it will not verify that the user is using your original software (rather than, e.g., a written-from-scratch clone).
Sep
23
comment Is it dangerous to post my MAC address publicly?
I'll certainly agree to that, and admit my statement wasn't very complete. Perhaps I should revise it to say that most situations in which an attacker can meaningfully use your MAC address are situations in which your MAC address is clearly visible when in use. Learning someone's MAC address might be valuable to an attacker if some particular combination of space/time/usage constraints would prevent them from learning it from your normal use.
Sep
23
comment What is the difference between session fixation and session recreation?
This question doesn't appear to be answerable, since there is no clear definition of the term "session recreation"; the question does not offer a definition or example, and the term is not in widely used in security. (A Google search for "session recreation" turns up this exact question as the fifth result, under four results about recreational events.) Perhaps you could give an except of the text where you've "read that both of them are conventionally the same"?
Sep
22
comment Is it dangerous to post my MAC address publicly?
+1; I suspect any scenario in which your MAC address would be useful to an attacker (e.g., a MAC-restricted WiFi network) is a scenario in which the attacker can already view your MAC address.
Sep
17
comment Closely spaced failed logins in auth.log
Your machine is accepting multiple simultaneous TCP connections (evidenced by the differing remote port numbers). However, per connection, it seems to be doing more than three attempts at less than a 3 second delay, which I can't explain.
Jun
30
comment Why isn't it possible for a third party to decrypt HTTPS traffic?
@Forivin No, because the client (in fact, anyone (!)) is able to encrypt any message in such a way that only the server can decrypt it. It doesn't matter if a bad guy gets his hands on such a message, because only the intended recipient can decrypt it. Furthermore, the client doesn't need any special knowledge to create such an encrypted message, because anyone in the world with the server's public key can do it. The server's public key is, of course, publicly available to all potential clients.
May
14
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
@AmirrezaNasiri Public-key systems are based on mathematical problems that are extremely difficult to perform in reverse. See the discrete logarithm problem for one such problem: for a = b^k mod q, it is trivial to compute a if you know b, k and q. However, it is difficult to find k, even if you know a, b, and q. The Wikipedia article has a good example and explanation.
Mar
23
comment Does Facebook store plain-text passwords?
Sort of a duplicate: security.stackexchange.com/questions/47840/password-security (since you ruled out a recently-entered password, most of the answers there don't quite apply perfectly, but some still do, and one of them is quite close to the top answer here)
Jan
1
comment Password security
@jamiescott Added your suggestion with a link to a related Secuirty.SE question.
Dec
31
comment Password security
@Ben That is a much better idea; done.
Oct
28
comment Brute Force In Order Or Random?
Assume your plaintext is in a space that can be enumerated N, N+1, N+2, ..., M. Your hash function ensures that finding H(X) for any X gives no new information about some other H(Y). Assuming in-use plaintexts fall uniformally at random within your enumerated plaintext space, then on average neither strategy (ordered or random guessing) will be any faster. The ordered approach would save you memory in an implementation, though (you store only the last guessed plaintext, rather than a full list). Note that the real world might disobey my above theoretical assumptions.
Oct
24
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out.