1,623 reputation
518
bio website andrewmichaelsmith.com
location United Kingdom
age
visits member for 3 years, 10 months
seen Dec 10 at 16:09

Software Developer


Mar
12
comment Download mirror security
This also means that even if the packages are distributed over HTTP a MITM attack would be fruitless
Sep
28
comment On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?
The strange this is that I was typing https://google.com in to the browser and it was occurring. However - I can't say for sure that that's what I did first, so maybe chrome had cached the redirect?
Sep
28
comment On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?
@Rock I was using Chrome
Sep
28
comment On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?
@CodesInChaos After posting this actually went from happening every time to becoming an intermittent issue. I was just using google normally (type search in to chrome bar) and google themselves showed a little box notifying me that I wasn't using SSL - I looked and I wasn't. But now I'm thinking this may be a different issue.
Sep
28
comment On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?
@CodesInChaos Exactly, that's what I was thinking. I'm now unsure, because my https connections are occasionally going through. So perhaps it's not the network being sneaky but some issue with my browser/google/something else
Sep
28
comment On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?
How would that work? Do you have an example of software that does this?
Mar
28
comment What is zero day?
Isn't this a grey area - we know buffer overflows exist but that doesn't discount every new buffer overflow because "oh, we know about buffer overflows already". So therefore should we be discounting a new SQL vulnerability in Jon's Cat Blog? It seems odd to refer to that as an 0day, however.
Mar
18
comment How would one crack a weak but unknown encryption protocol?
I'm possibly being a bit pedantic here but isn't it "as good as nothing" rather than being "worse than nothing"?
Mar
8
comment What are the disadvantages of Tor?
So you're proposing limiting SSH login to only allow it from Tor? I'm not quite sure how you'd implement that but even if it is possible what's the point? It would be far better/simpler to limit SSH login to your I.P address(es). Also, as anyone can use Tor you're not really restricting people from accessing it - just obscuring it a little
Jan
21
comment How unlikely is it that a Google Doc link is guessed?
And not forgetting the link hanging around in someone's browser history
Jan
15
comment How can I tell whether this computer is part of a botnet?
If it's a virus it's a very poorly written one! Is it possible that someone has installed some legitimate software that has these as dependencies? It sounds like unxutils.sourceforge.net. It's possible there are some programs out there that needs these installed
Jan
10
comment Why do some antivirus programs find infections that others miss?
@illsecure don't do this! VirusTotal is a great tool but anti-virus tools do more than just scan executables (such as use of heuristics). See prevx.com/blog/106/… for more information.
Dec
11
comment Banking application login leaks information
"If the username exists then show image" - I think here you've made an assumption that I have personally never seen. Usually it is the case that "if the username and password is correct then show image"
Nov
16
comment What XSS attacks doesn't “Reflective XSS Protection” defeat?
So what I guess what I'm really interested to know is are there any evasion techniques that mean that by design reflective XSS protection won't work? Is it just going to be a game of catch up forever or has someone found a really tricky evasion mechanism that webkit could not block for x reason
Nov
16
comment What XSS attacks doesn't “Reflective XSS Protection” defeat?
So are there any examples of such bypasses? Is there such a bypass that for some technical reason cannot be blocked? Or can all be eventually blocked?
Nov
16
comment What XSS attacks doesn't “Reflective XSS Protection” defeat?
And of course I have notified the owner of the website of the issue! :)
Nov
1
comment Use HTTP POST for Google Search queries
For this specific question using a POST request is pointless but there are cases where it improves security. GET URLs are kept in the browsers history and may be obtained at a later date. Obviously with a search query this makes no different - the history will contain the resulting page which will also contain the query. But in the case of credit card data (for example) this should stay in the POST request, even on HTTPS!
Nov
1
comment Is it necessary to scan users' file uploads by antivirus?
I agree that anti-virus is over kill but perhaps running some kind of normalization on the data before passing it to the parser might reduce risk.
Oct
13
comment I stupidly responded to an email from a hacker posing as a friend
Sounds like you're fine - the only thing I can see happening from this is your email address being starred as someone to phish again :). Keep your passwords different and complicated, you'll be fine.
Oct
12
comment I stupidly responded to an email from a hacker posing as a friend
What information did you provide to the phisher?