31,205 reputation
1398131
bio website
location Finland
age
visits member for 2 years, 5 months
seen 2 hours ago

Mildot


1d
comment What is the difference between Tails and Tor?
Here's Tor, and here's Tails. Reading the Wiki summary in both links is sufficient to know the difference.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, it's actually a lot better to just host a fake version of good.com on evil.com itself without reverse-proxying at all. This way, you can just grab the username/password without injecting any scripts in the page and possible alerting the user. Another benefit of avoiding reverse-proxying is that you, the attacker, won't have to interact with the server, and your evil.com won't appear on good.com's access logs. I honestly cannot think of a reason why reverse-proxying is beneficial to an attacker in a way other easier attacks aren't.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Nathan In that case, then the attacks is almost meaningless. Any unauthenticated action you can get the user to perform can be done programatically without the user and from the comfort of your own computer without launching any attack. Unless there's a specific button on some website and you want as many users as possible to click that button (usually ad-clicking fraud). In that particular case (unathenticated user performing an unauthenticated action), you're correct to assume that a reverse-proxy-aided attack and a clickjacking attack are quite similar, if not essentially the same.
Mar
23
comment Is Clickjacking a real security vulnerability?
@Jeroen-ITNerdbox Not really. When the user visits evil.com, he will be presented with a full version of good.com loaded entirely from evil.com. All requests, including the first request loading the page itself and then any subsequent requests, are going to evil.com from the user browser's point of view. No client-side protection can prevent this. The only way this can be protected is by informing users to check the address bar for https://good.com
Mar
23
comment Is Clickjacking a real security vulnerability?
@Daniel: Nathan (OP) has demonstrated a clear understanding of how Clickjacking works. Plus, nope, same-origin restrictions have nothing to do with the scenario proposed by Nathan.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob Yes! With Git you can give the developers you want access to the projects you want. Everything can be separated.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob You can't control code theft.. ever.. ever. If someone has access to the code, and they want to steal it, they will steal it. Hire people you trust, and make them sign NDAs. That's all you can do.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
Once they have Git, each developer can have their own credentials and explicit permissions to access the projects as needed.
Mar
4
comment Is creating secondary account on Black-Box Pentest Forbidden?
Did you disclose the secondary accounts to the customer as soon as you finish the pentest? If not, then it's your fault.
Feb
7
comment Is this a valid Windows update page
@2xMax You want a proof that *.microsoft.com domains are legitimate Microsoft domains?
Jan
28
comment Conspicuous changes in the encrypted Truecrypt container
@ThorstenS. Could you please show us the script? Put it on pastebin and post the link here as a comment.
Dec
3
comment How can you be caught using Private VPN when there's no logs about who you are?
@ColeJohnson Yes, and this answer applies to it. PRQ operates in Sweden, which means they're forced under "Lag (2003:389) om elektronisk kommunikation", that explained in the post, to cooperate with law enforcement to give information about and trace hackers and other users who commit illegal activities. In fact, in their very own ToS you can read that. "PRQ shall keep confidential and not disclose information regarding the Customer except where this required by law". Actually, their ToS even specifies hacking as something they don't allow.
Nov
27
comment Password Storage - Self Encryption vs Hashing?
The answer to your question is in Tom's answer (the one you linked). A secure password storage scheme must be slow and salted. Your encryption scheme is neither. Therefore, it's not secure.
Nov
9
comment Is email encryption, as claimed by ProtonMail, possible?
Yes, it's possible.
Oct
8
comment Is TCP more secure than UDP?
@Ulkoma Nope. Reliability has nothing to do with confidentiality or integrity here. It is what the most obvious definition is: With TCP you're more confident that stuff will go from A to B and arrive there than with UDP (you know, because TCP verifies that the packet was received and re-sends in case it wasn't)
Oct
8
comment What is TCP spoofing?
It's just a poorly worded answer. Philip just confused terminology, which confused you (and, confused me as well). TCP spoofing refers to the network engineering process of improving the performance of the protocol due to inadequacies in certain conditions (more on that). IP spoofing is falsifying the IP address to make the connection appear as it's coming from somewhere other than the real source. The spoofing that Philip is talking about is modifying the content of a TCP message in transmit (lack of integrity).
Oct
8
comment Is TCP more secure than UDP?
oh, looks like I'm not the only confused by the poorly worded paragraph, security.stackexchange.com/questions/69181/what-is-tcp-spoofing
Oct
8
comment Is TCP more secure than UDP?
As far as I know, and please correct me if I'm wrong, once you talk about TCP/UDP and spoofing, then it's automatically assumed you're talking about making a connection (in case of TCP) appear to be coming from a source that isn't the real source. Unless of course you mean the network engineering process Protocol Spoofing en.wikipedia.org/wiki/Protocol_spoofing#TCP_spoofing (and I don't think you're talking about that)
Oct
8
comment Is TCP more secure than UDP?
Oh, I'm sorry. Perhaps I wasn't clear. I was politely saying that you're last paragraph is poorly worded, of low quality, and possibly stating incorrect information (unless you elaborate). I wasn't asking for extra info, I was telling you to fix your answer (in case it's wrong, which is only clear if you elaborate what you mean by spoofing).
Oct
8
comment Is TCP more secure than UDP?
Could you please expand on the last paragraph? What exactly do you mean by "spoof"? As far as I know, TCP isn't not only a tad bit harder to spoof, it's actually a lot harder to spoof.. like really really harder.