Reputation
775
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 28
Newest
 Constituent
Impact
~23k people reached

Jul
27
comment Is there an equivalent of meterpreter's “run persistence” for Linux?
The current user's.
Jul
27
comment Is there an equivalent of meterpreter's “run persistence” for Linux?
...which justifies creating a specialized script for that.
Jul
27
comment Is there an equivalent of meterpreter's “run persistence” for Linux?
I Googled that adding an authorized_keys could probably also work, but I was wondering if there is any "standard" script that gathers those techniques.
Jun
11
comment Is there a way to attack STARTTLS + certificate pinning probed from multiple places?
Nothing other than CRL comes to my head.
Jun
11
comment Is there a way to attack STARTTLS + certificate pinning probed from multiple places?
I agree that this is one of the problems. On the other hand, he also needs to intercept the very first session or the certificate would be pinned.
Jun
4
comment Why is there a preference towards long passphrases instead of increasing the hashing iterations?
I don't think that's the case. Adding salt would trivially defeat that.
Jun
4
comment Why is there a preference towards long passphrases instead of increasing the hashing iterations?
Ah, sorry, it wasn't. I just fixed it.
Mar
9
comment What are the security implications of “Row Hammer” attack?
It might not if in the end the exploit is able to access the flat memory.
Mar
5
comment Possibility to sniff HTTPS traffic on devices without installing a certificate
It doesn't take trillions of dollars to do these things. These are basically done every month.
Jul
23
comment What Linux software can I use to explore entropy of a file?
I didn't mention that I consider compressing with gzip as a good way to detect if the file is already compressed. Still, thanks for the writeup, though it doesn't really answer my question.
Jul
9
comment What are some considerations before moving personal data to Google Drive?
I would also note that it's not a requirement for the agency name to consist of three laters. Vide GCHQ.
Apr
21
comment How does BGP filtering work to prevent routing hijacking?
Could be merged with: security.stackexchange.com/q/56069/15648
Apr
7
comment How can NSA see everything without us noticing that?
@RoryAlsop: could you elaborate?
Apr
7
comment How can NSA see everything without us noticing that?
Okay, but world isn't USA only. There are other countries, other continents.
Apr
7
comment How can NSA see everything without us noticing that?
Personally I don't understand how it relates to my question.
Apr
7
comment How can NSA see everything without us noticing that?
You can theorize and still refer to the facts you know.
Apr
7
comment How can NSA see everything without us noticing that?
How is that? We're theorizing about an attack on a system we know very little about. My question is, among other things, about processes that could produce such a gigantic system in a way that it remains undetectable.
Jan
21
comment RSA key recovery using sound - How does it work?
Well, I guess that you might be right. My question is a bit broader though.
Jan
21
comment How to know if connection is encrypted
I wanted to point out that padlock is not always visible in the browser. Embedding a HTTPS website in a HTTP one using <iframe> breaks this.
Jan
21
comment In Tor, what stops the end server from following the breadcrumbs back to their origin?
I don't like the answer. You seem to imply that the legal issue is the only problem here. Doesn't Tor use some kind of forward secrecy?