Reputation
4,788
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 28
Newest
 Caucus
Impact
~130k people reached

  • 0 posts edited
  • 13 helpful flags
  • 195 votes cast
Jun
15
comment Why did I see an insecure browser warning on my page?
@Joon Looking at the browser console (F12) for that page, I see a warning about an insecure image, not a link: Mixed Content: The page at 'https://secure.myshopper.oldmutual.co.za/shopper/FundEdit' was loaded over HTTPS, but requested an insecure image 'http://image.providesupport.com/online-presence-image/omtfsa?t=...'. This content should also be served over HTTPS.
Jun
11
comment Why did I see an insecure browser warning on my page?
I'm voting to close this question as off-topic because it is predicated on a mixed-content warning appearing under circumstances that do not appear to produce a mixed-content warning in practice. (Please add more information and/or an example that reproduces the warning. It is entirely possibly that links do produce mixed-content warnings, but only under specific circumstances. Without such information, this question cannot be answered.)
Jun
11
comment Why did I see an insecure browser warning on my page?
For example, I do not see any warnings on ondras.github.io/rot.js/hp, even though it links to http://doryen.eptalys.net/libtcod/.
May
28
comment Is this way of encoding cryptographic hashes safe?
@Gilles An excellent point. I hope my edit does your comment justice?
May
27
comment Is this way of encoding cryptographic hashes safe?
@Polynomial I'm not suggesting that the extra digit is dropped; I agree that it does remain, and that that causees a problem. If the groups 03f and f43 are adjacent in the input (11 and 111 in the output), it is not possible to use the five character 11111 in the output to determine which group came first in the input. To restate a much shorter version of my previous example, the output from 03ff43 and f4303f are indistinguishable.
May
27
comment Is this way of encoding cryptographic hashes safe?
@Polynomial 03ff4303ff43...03ff439991 and f4303ff4303f...f4303f9991 both map to the same output value (1111111111...1111111CC1). There are lots of ways to modify the scheme so it doesn't cause collisions (I have suggested a few trivial ones), but as presented in the question, values can collide.
May
27
comment Is this way of encoding cryptographic hashes safe?
If this were a bijective transformation, this would be perfectly correct; unfortunately, it is not. Three hex digits can express 4096 values, while two base62 digits can only express 3906 values, which sometimes requires the scheme to use three base62 digits. If this scheme had used leading zeroes, it could work (but I suppose that would defeat the entire point, mapping 3 digits onto three digits). Note the three-digit 11p and 12m output groups in the question's example.
May
18
comment Signing (HMAC) cookie identifier
Just to give an example, suppose the server's token generator is just a counter. If you have token 17, you can be pretty sure 16 and 18 are valid tokens, too. If an attacker needs a MAC of that token, though, then knowing that 16 is a valid token doesn't help (because the token is really 16 and HMAC(16, secret_key)).
Apr
27
comment Is browsing http sites insecure?
@Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script
Apr
22
comment Is this symetric or asymetric encryption?
Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase.
Apr
22
comment Is this symetric or asymetric encryption?
"salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions.
Apr
3
comment Is having the username and password fields on different pages more secure?
The only benefit I can think of is that it gives the user slightly longer to identify a phishing attack if the site is a fake duplicate. Closely related: Is SiteKey a valid defense against Phishing?
Apr
2
comment Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?
Where did you see the term "web bugs" used that caused confusion? The context in which you saw the phrase (or intend to use the phrase) may help to provide a good answer. "Web bugs" could mean a defect with some Web technology (a "bug" defect) or a tracking technique (e.g., you've been "bugged" by a tracking device).
Apr
2
comment Can all of Facebook's data be wiped out?
A good answer to this question would need to outline Facebook's approach to physical storage of their data (surely not a simple task and probably requires some degree of speculation), then address how to go about attacking that data storage from a variety of threat models (outside network attacker, physical infiltration, insider threat, nation state, etc.). I think this question is too broad, and needs to narrow down its assumptions about an organization's data storage (i.e., not necessarily Facebook but some organization whose storage looks like X) and narrow its threat model.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Thanks, that's very helpful clarification. If you edit your question to include all that information (link to the paper, information you already understand, formality of the answer you're looking for), it will make it a lot easier for someone to provide a good answer to your question.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
It would also be helpful to edit your question to clarify how much you already understand about homomorphic encryption. Currently, it's not clear how much background information a good answer should give.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
"We define the relaxed notion of a semi-homomorphic encryption scheme, where the plaintext can be recovered as long as the computed function does not increase the size of the input "too much"." Which part, specifically, of this definition gives you problems? The system has a homomorphism the allows a function over ciphertext, but the function will give faulty results if the output of the homomorphic function would be substantially greater than the input. Your question is not very specific. Is this the category of answer you are looking for, or do you need a more exact definition?
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Where, specifically, have you seen the term semi-homomorphic used? It's helpful to know what you've already learned about the topic.
Mar
30
comment Need some docs that say we shouldn't upper the string when saving it as a password
In what way does conversion to all-uppercase not violate the recommendation mixed-case passwords be allowed? Such a to-uppercase practice is incompatible with mixed-case passwords (since no password, as your application understands passwords, could ever have a lowercase letter).