2,305 reputation
617
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 1 month
seen 16 mins ago

"The problem, when solved, will be simple."

Conway's Game of Life

  Controls:
  Step Random Noise
  Clear Random Feature
  Click a cell to toggle it.
  View source


Sep
26
comment How is a cypher algorithm verified?
Maybe a duplicate: What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms? "Why can't they prove any of their algorithms secure? ...there are fundamental reasons that make it very difficult to prove that an encryption algorithm is secure... proving that an algorithm like AES or RSA or SHA256 is secure seems likely to be at least as hard as proving that P != NP"
Sep
25
comment GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?
Anything your bash shell can do, an exploit that controls your bash shell can do. Can your bash shell do anything besides manipulate your repositories? (Note, however, that your chance of attack is may be reduced, because nothing else uses your bash shell. My understanding is that, in *nix, this is a huge problem because lots of other software depends on bash and environment variables. In Windows, it's less likely that any other software is set up to invoke your vulnerable bash shell.)
Sep
23
comment Ensuring an HTTP request is coming from my program
Regarding your "password" approach, this is exactly how API keys work. However, that will only uniquely identify the user; it will not verify that the user is using your original software (rather than, e.g., a written-from-scratch clone).
Sep
23
comment Is it dangerous to post my MAC address publicly?
I'll certainly agree to that, and admit my statement wasn't very complete. Perhaps I should revise it to say that most situations in which an attacker can meaningfully use your MAC address are situations in which your MAC address is clearly visible when in use. Learning someone's MAC address might be valuable to an attacker if some particular combination of space/time/usage constraints would prevent them from learning it from your normal use.
Sep
23
comment What is the difference between session fixation and session recreation?
This question doesn't appear to be answerable, since there is no clear definition of the term "session recreation"; the question does not offer a definition or example, and the term is not in widely used in security. (A Google search for "session recreation" turns up this exact question as the fifth result, under four results about recreational events.) Perhaps you could give an except of the text where you've "read that both of them are conventionally the same"?
Sep
22
comment Is it dangerous to post my MAC address publicly?
+1; I suspect any scenario in which your MAC address would be useful to an attacker (e.g., a MAC-restricted WiFi network) is a scenario in which the attacker can already view your MAC address.
Sep
17
comment Closely spaced failed logins in auth.log
Your machine is accepting multiple simultaneous TCP connections (evidenced by the differing remote port numbers). However, per connection, it seems to be doing more than three attempts at less than a 3 second delay, which I can't explain.
Jun
30
comment Why isn't it possible for a third party to decrypt HTTPS traffic?
@Forivin No, because the client (in fact, anyone (!)) is able to encrypt any message in such a way that only the server can decrypt it. It doesn't matter if a bad guy gets his hands on such a message, because only the intended recipient can decrypt it. Furthermore, the client doesn't need any special knowledge to create such an encrypted message, because anyone in the world with the server's public key can do it. The server's public key is, of course, publicly available to all potential clients.
May
14
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
@AmirrezaNasiri Public-key systems are based on mathematical problems that are extremely difficult to perform in reverse. See the discrete logarithm problem for one such problem: for a = b^k mod q, it is trivial to compute a if you know b, k and q. However, it is difficult to find k, even if you know a, b, and q. The Wikipedia article has a good example and explanation.
Mar
23
comment Does Facebook store plain-text passwords?
Sort of a duplicate: security.stackexchange.com/questions/47840/password-security (since you ruled out a recently-entered password, most of the answers there don't quite apply perfectly, but some still do, and one of them is quite close to the top answer here)
Jan
1
comment Password security
@jamiescott Added your suggestion with a link to a related Secuirty.SE question.
Dec
31
comment Password security
@Ben That is a much better idea; done.
Oct
28
comment Brute Force In Order Or Random?
Assume your plaintext is in a space that can be enumerated N, N+1, N+2, ..., M. Your hash function ensures that finding H(X) for any X gives no new information about some other H(Y). Assuming in-use plaintexts fall uniformally at random within your enumerated plaintext space, then on average neither strategy (ordered or random guessing) will be any faster. The ordered approach would save you memory in an implementation, though (you store only the last guessed plaintext, rather than a full list). Note that the real world might disobey my above theoretical assumptions.
Oct
24
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
"Is there any point in CAs giving customers these images to put on the page?" -- It's good(?) advertising for the CAs? Certainly I can't see any good reason why the customers should put them up, but I can see a business case for why the CAs would give them out.
Oct
18
comment Why is the Access-Control-Allow-Origin header necessary?
So, if I might summarize: a browser client could act as an intermediary to help a malicious server reach some destination resource R, normally accessible to only you. Normally, we consider the case where R is protected by a cookie-based auth token system, but you present a situation in which R is protected by network topology instead. The OP's imagined browser (which always assumes A-C-A-O:*) would violate network-topology-based protection.
Oct
17
comment Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?
@MattMcClure I actually like your edit -- you've asked a very expansive question, and I could only answer most of it. Normally (if it weren't my own answer), I'd advise posting a new answer alongside this one, but in this case I'm happy to have your edits address the components of your question that I didn't answer. Even if you linked to this comment, though, it's still likely your edit would get unfortunately rejected; would you like me to edit in your changes myself, or would you like to take a second shot at it?
Oct
2
comment Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?
Possible duplicate of Compute the AES-encryption key given the plaintext and its ciphertext? (The question is AES-specific, but the answers are generally sufficient to answer this generally-scoped question.)
Oct
1
comment Can older or custom web browsers override the same origin policy?
Could you clarify what you mean by "overhauling my site"? Are you concerned that a site will perform a cross-origin Ajax fetch of your site, overhaul the appearance, and present the altered version to the user? Or are you concerned about a large number of requests overwhelming your site? The first case is much more applicable to SOP concerns, but I now suspect the second case is closer to what you meant. (As noted below, any group of machines capable of participating in network activity could overwhelm your site.)
Oct
1
comment Can older or custom web browsers override the same origin policy?
@PeterStuart I initially misunderstood your threat model, and have added an additional paragraph. Assuming the SOP will protect your site is like assuming that because a person has seat belts in his car he can't get out and attack you. (The seat belt is there to protect the driver of the car, not you.)
Sep
30
comment Does Google's SSL encryption for searches thwart NSA spying?
Regarding your redirect-to-HTTPS comment, it's worth noting to the OP that Google uses HSTS, which eliminates the redirect entirely, after the first visit. (Of course, the first visit is still vulnerable in the way described here.)