Reputation
31,903
Next tag badge:
160/100 score
19/20 answers
Badges
13 100 137
Newest
 Nice Answer
Impact
~1.2m people reached

Apr
19
reviewed Close How is Facebook Spam/Hacks Achieved?
Apr
19
reviewed Close Encrypting user credentials using AES: how to hide the key
Apr
18
reviewed Leave Closed How does Silverlight protect the AES keys it gets from PlayReady?
Apr
18
reviewed Close How do I allow for anonymous encryption?
Apr
18
reviewed Close Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info
Apr
18
reviewed Close ISO27001 Certification - Business Incident
Apr
18
reviewed Close Should I be afraid of biometric IDs?
Apr
17
awarded  Guru
Apr
10
reviewed Reject What does this malicious JavaScript code do?
Apr
2
reviewed Reject Testing clean urls with sqlmap
Apr
2
reviewed Edit ProtonMail security concerns
Apr
2
revised ProtonMail security concerns
add source and license for image
Mar
26
awarded  Guru
Mar
23
awarded  Good Answer
Mar
23
revised Is Clickjacking a real security vulnerability?
added 73 characters in body
Mar
23
awarded  Nice Answer
Mar
23
awarded  Nice Answer
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, it's actually a lot better to just host a fake version of good.com on evil.com itself without reverse-proxying at all. This way, you can just grab the username/password without injecting any scripts in the page and possible alerting the user. Another benefit of avoiding reverse-proxying is that you, the attacker, won't have to interact with the server, and your evil.com won't appear on good.com's access logs. I honestly cannot think of a reason why reverse-proxying is beneficial to an attacker in a way other easier attacks aren't.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, then the attacks is almost meaningless. Any unauthenticated action you can get the user to perform can be done programatically without the user and from the comfort of your own computer without launching any attack. Unless there's a specific button on some website and you want as many users as possible to click that button (usually ad-clicking fraud). In that particular case (unathenticated user performing an unauthenticated action), you're correct to assume that a reverse-proxy-aided attack and a clickjacking attack are quite similar, if not essentially the same.
Mar
23
revised Is Clickjacking a real security vulnerability?
edited body