31,385 reputation
1399132
bio website
location Finland
age
visits member for 2 years, 6 months
seen 2 hours ago

Mildot


Apr
2
revised ProtonMail security concerns
add source and license for image
Mar
26
awarded  Guru
Mar
23
awarded  Good Answer
Mar
23
revised Is Clickjacking a real security vulnerability?
added 73 characters in body
Mar
23
awarded  Nice Answer
Mar
23
awarded  Nice Answer
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, it's actually a lot better to just host a fake version of good.com on evil.com itself without reverse-proxying at all. This way, you can just grab the username/password without injecting any scripts in the page and possible alerting the user. Another benefit of avoiding reverse-proxying is that you, the attacker, won't have to interact with the server, and your evil.com won't appear on good.com's access logs. I honestly cannot think of a reason why reverse-proxying is beneficial to an attacker in a way other easier attacks aren't.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, then the attacks is almost meaningless. Any unauthenticated action you can get the user to perform can be done programatically without the user and from the comfort of your own computer without launching any attack. Unless there's a specific button on some website and you want as many users as possible to click that button (usually ad-clicking fraud). In that particular case (unathenticated user performing an unauthenticated action), you're correct to assume that a reverse-proxy-aided attack and a clickjacking attack are quite similar, if not essentially the same.
Mar
23
revised Is Clickjacking a real security vulnerability?
edited body
Mar
23
comment Is Clickjacking a real security vulnerability?
@Jeroen-ITNerdbox Not really. When the user visits evil.com, he will be presented with a full version of good.com loaded entirely from evil.com. All requests, including the first request loading the page itself and then any subsequent requests, are going to evil.com from the user browser's point of view. No client-side protection can prevent this. The only way this can be protected is by informing users to check the address bar for https://good.com
Mar
23
answered Is Clickjacking a real security vulnerability?
Mar
23
comment Is Clickjacking a real security vulnerability?
@Daniel: Nathan (OP) has demonstrated a clear understanding of how Clickjacking works. Plus, nope, same-origin restrictions have nothing to do with the scenario proposed by Nathan.
Mar
20
awarded  Enlightened
Mar
20
awarded  Nice Answer
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob Yes! With Git you can give the developers you want access to the projects you want. Everything can be separated.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob You can't control code theft.. ever.. ever. If someone has access to the code, and they want to steal it, they will steal it. Hire people you trust, and make them sign NDAs. That's all you can do.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
Once they have Git, each developer can have their own credentials and explicit permissions to access the projects as needed.
Mar
17
revised How can I prevent that my users get a certificate issued for my domain on my behalf?
added 302 characters in body
Mar
13
awarded  Nice Answer
Mar
9
reviewed Reject BitLocker Drive Encryption NOT secure from drive mapping on network