1,032 reputation
518
bio website markhaase.com
location Washington, DC
age 32
visits member for 4 years, 2 months
seen Apr 22 at 2:50

Feb
27
awarded  Yearling
Feb
26
comment Superfish vs. Corporate MITM
@Iszi "it's their own fault" Unfortunately, your myopic attitude towards users is far too common in the security industry. Do you read every 30 page AUP before you sign up for a web site? No, you don't. And users don't carefully read the AUP they sign at work. They just want the job.
Feb
26
comment Superfish vs. Corporate MITM
@jvonscha: Agree with you 100%. If companies really wanted to be transparent about what they are doing, they would insert some HTML into intercepted web pages saying, "this page is monitored by your employer, click <here> for more info." Most IT depts I have seen aren't interested in that kind of transparency.
Feb
26
comment Superfish vs. Corporate MITM
@raz: I would guess that most users don't realize that, e.g. when they check their bank balance at work, their employer can see everything. Of course, the users probably signed agreements allowing for such monitoring, but still I think they often don't realize exactly what that means... I'm constantly explaining this to non-tech people.
Feb
21
comment Why was the private key of the Superfish certificate so easily extractable?
For a hands on experiment, try playing with mitmproxy. It's a proxy server that makes it easy to man-in-the-middle your own TLS connections. Like Superfish, it generates certificates on the fly to match the site you're looking at, and it signs each cert with a key that is stored local to the proxy, e.g. ~/.mitmproxy/mitmproxy-ca.pem. If you trust MITM proxy's CA certificate, then all of the on-the-fly certificates that it signs will also be trusted.
Feb
13
awarded  Popular Question
Feb
2
comment Requirement to send username and password in distinct email messages
For what it's worth, the U.S. federal government does this across the board. It's a very CISSP-y thing to do.
Jan
22
comment Is authenticating via the database secure
Depends on which hash function you are using. The DBMS may have an implementation of the hash function; in that case, you can perform the check in a single query.
Jan
22
comment Is authenticating via the database secure
This is a good answer, but is omitting an important detail. Some DBMS have hash functions built in, e.g. SELECT * FROM user WHERE userid=? AND passwd=SHA1(?). Good password hashing uses "hard" hashes, though, such as bcrypt, scrypt, PBKDF2, etc., which are not built in to most DBMS.
Jan
4
awarded  Notable Question
Dec
31
comment Adding intermediate page to navigate out of the current site
@AndréDaniel Also an open redirect can be used to craft URLs that look safe but lead to malicious sites, e.g. https://myback.com/redirect.php?http%3A%2F%2Fbadguys.com. Many naive users are easily fooled by this. Some advanced users may also be tricked, because most browsers that show link destinations will truncate the end of a very long link.
Dec
4
comment Preventing Illegal Access to Webservice
"Another idea was to restrict access by MAC address." This only works for devices that are on the same subnet as your server, because MAC addresses are layer 2 and IP routing is layer 3.
Aug
21
comment Open exploits database, with structured data (CMS name, version, etc.)
You're confusing the term "exploit" with "vulnerability". A vulnerability is a flaw in a program, while an exploit is a demonstrated use of that flaw. (Also, I'd be remiss if I didn't plug my own SCAP solution which has a better API than the NVD: scapsync.com)
Jul
31
comment Feeding /dev/random entropy pool?
I just faced this problem while trying to generate GPG keys on a virtual server. I found that downloading a large ISO (say a linux distribution DVD) adds entropy pretty quickly.
Jul
17
awarded  Popular Question
Jul
7
comment Does cross platform (authenticated) volume encryption exist?
@Mark Good point. I'm thinking of an encrypted disk image, not necessarily a physical drive.
Jul
6
asked Does cross platform (authenticated) volume encryption exist?
Jul
2
awarded  Curious
May
5
revised How to get public key of a secure webpage?
Select better tags.
May
5
suggested approved edit on How to get public key of a secure webpage?