292 reputation
18
bio website
location
age 30
visits member for 1 year, 6 months
seen yesterday

Lucky those who have knowledge to help and assist others :)


Apr
8
comment Heartbleed and Routers/ASAs/other
+1 I would also like to know if OpenSSH is vulnerable. It also features a heartbeat thing (freecode.com/projects/openssh-watchdog) but I cannot find out quickly if that is linked to the heartbeat features's bug in OpenSSL
Apr
8
comment What should end-users do about Heartbleed?
@ChrisO'Kelly Update Browsers, because of the update of the certificates that will occur now? thanks for acclarification. maybe you can phrase your comment to an answer?
Apr
7
comment Is there a way to prevent software from accessing hardware IDs?
can you also specify which "software" you mean? drivers are software. Shareware is software. A webbrowser is software. surely it might matter
Apr
6
comment Techniques for enumerating enabled apache modules
Do I miss the part where the tool gives info about the installed apache modules? How for instance would I know from the output if mod_rewrite.c was enabled or not?
Apr
6
comment Is it illegal to publicly reveal security flaws in a service?
Also interesting to know does the site owner brakes the law, knowingly ignore the security flaw risking users' data?
Apr
6
comment is there any 100% secure way for form authentication and sending information from client side to server side over internet pages?
+1 Adding to the above: Using SSL might require to trust the involved CA which also defeats 100% security goal :)
Apr
6
asked Enabling virutalization, addressing the bluepill risk?
Apr
6
comment PHP encrypt and decrypt with certificate
How does the key signing play a role here?
Apr
6
comment PHP encrypt and decrypt with certificate
"need to get the private key on the receiving end" is maybe not the best concept. You would rather "get the public key to the sending end"
Apr
6
comment PHP encrypt and decrypt with certificate
+1 for being good enough to mention that in most cases (message length > keylegth of asymmetric key) symmetric encryption is used internally. Showing that the decision in this case is really not possible. It will also be symmetric ciphers involved.
Apr
6
comment PHP encrypt and decrypt with certificate
the feature that the receiving end is limited to decrypting the message and prevented from encrypting, required that the "public key" is not really public, right?
Apr
6
revised Why are apps for mobile devices more restrictive than for desktop?
added a paragraph
Apr
6
answered Why are apps for mobile devices more restrictive than for desktop?
Apr
6
comment How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?
what is malicious about posting an image file with *.png extension when you say next, that your forum does indeed allow *.png? If the forum would even allow *.png files is it not actually the intented behaviour that a user posts it? Can you explain what you mean with that it was "masked with .htaccess"? Maybe post the content of .htaccess to allow better insight! DO you mean httpd.apache.org/docs/current/rewrite/intro.html this with "masking"?
Apr
4
comment Secure authentication: partial client-side key stretching… please review/criticize my idea
Does SRP mentioned suffer from the issue to slow down the performance client-side. Being implemented in JavaScript(true?) how would you consider performance risks?
Apr
3
comment After I downloaded Adblock plus on my computer, ads still popped up on youtube? What gives?
what is the part that is linked to the topi security? The question about if Adblick plus is authentic? If so I suggest you give more insights regarding the way that you acquired that software... If you simple tell that you download something it is hard to answer if it is authentic or not. There is any chance it is not?
Apr
3
comment Why is symmetric encryption still used?
Are you certain that you understood the difference between symmetric and asymmetric encryption? At least to my knowledge it is not common to say private key encryption. At best I think there is something like decryption + signing using the private key of an RSA public+private key pair
Apr
3
comment Is it possible to encrypt a file so that it can not be brute forced?
can you tell: what is srrs?
Apr
3
comment HTTPS login vs MITM attack
maybe the answer could/should also highlight the role encryption (or missing encryption/signing) plays in the DNS.
Apr
3
comment HTTPS login vs MITM attack
even without a first request from the client, the browser knows that it HSTS? if so how? if not how can this avoid that there is a forged malicious webpage send as a response to facebook.com (instead of the original malicious ;)