29,603 reputation
1290126
bio website
location Finland
age
visits member for 2 years
seen 37 mins ago

I enjoy working with security stuff. Wanna talk about it? Drop me a line


Nov
9
comment Is email encryption, as claimed by ProtonMail, possible?
Yes, it's possible.
Oct
8
comment Is TCP more secure than UDP?
@Ulkoma Nope. Reliability has nothing to do with confidentiality or integrity here. It is what the most obvious definition is: With TCP you're more confident that stuff will go from A to B and arrive there than with UDP (you know, because TCP verifies that the packet was received and re-sends in case it wasn't)
Oct
8
comment What is TCP spoofing?
It's just a poorly worded answer. Philip just confused terminology, which confused you (and, confused me as well). TCP spoofing refers to the network engineering process of improving the performance of the protocol due to inadequacies in certain conditions (more on that). IP spoofing is falsifying the IP address to make the connection appear as it's coming from somewhere other than the real source. The spoofing that Philip is talking about is modifying the content of a TCP message in transmit (lack of integrity).
Oct
8
comment Is TCP more secure than UDP?
oh, looks like I'm not the only confused by the poorly worded paragraph, security.stackexchange.com/questions/69181/what-is-tcp-spoofing
Oct
8
comment Is TCP more secure than UDP?
As far as I know, and please correct me if I'm wrong, once you talk about TCP/UDP and spoofing, then it's automatically assumed you're talking about making a connection (in case of TCP) appear to be coming from a source that isn't the real source. Unless of course you mean the network engineering process Protocol Spoofing en.wikipedia.org/wiki/Protocol_spoofing#TCP_spoofing (and I don't think you're talking about that)
Oct
8
comment Is TCP more secure than UDP?
Oh, I'm sorry. Perhaps I wasn't clear. I was politely saying that you're last paragraph is poorly worded, of low quality, and possibly stating incorrect information (unless you elaborate). I wasn't asking for extra info, I was telling you to fix your answer (in case it's wrong, which is only clear if you elaborate what you mean by spoofing).
Oct
8
comment Is TCP more secure than UDP?
Could you please expand on the last paragraph? What exactly do you mean by "spoof"? As far as I know, TCP isn't not only a tad bit harder to spoof, it's actually a lot harder to spoof.. like really really harder.
Oct
1
comment What should a security audit report include?
I'd like to add that GIAC has what appears to be a security audit report on their systems (mirror). It is a very detailed report with good references and appendices. It's nearly 70 pages but it's definitely worth the read
Sep
25
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
@Falco Umm.. no? Because the insecure JS/CSS and insecure image warnings are completely different. The insecure image warning is a small warning and you don't have to do anything about it (defaults to allow), but the insecure JS/CSS is a warning that specifically tells you that it's a script and you need to do some actions to load it (defaults to deny).
Sep
25
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
@Falco Apologies, you're right about one thing. It is indeed a mixed content warning triggered by the merchant logo (which is the only thing transmitted via plain HTTP). In this case, it's also not a problem at all. It's an image. The worst that can happen is that MiTM might changes the image to another image, no big deal. Also, browsers don't supply referrer information from HTTPS to HTTP, so that's also covered. All in all, you're wrong, you're over reacting, and yes it's safe.
Sep
25
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
@Falco Ha?! That triangle information sign isn't a mixed-content warning. It's telling the user that the server isn't supplying full identity information in the certificate. Not a big problem at all.
Sep
25
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
@DavidZ Indeed it is. It also implements two-factor authentication with OTPs.
Sep
25
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
@SteveJessop While I certainly agree that sending your bank's creds to PayPal will probably break your bank's T&C (much like using Mint.com), I still think it's irrelevant in this context. Breaking your bank's T&C is a legal issue, while the question whether the creds are sent to PayPal is a technical security-related one. In all cases, I'm happy that you mentioned it.
Sep
23
comment Is it dangerous to post my MAC address publicly?
@apsillers I'll have to disagree. That only works if you're connected and using the network at the time the attacker is attempting to grab the MAC address. If you're not connected to the network, then the attacker must acquire the MAC address through other means.
Sep
18
comment Why is it a security problem not to update one's browser?
@user10008 I'd add: Not only the ones that come in contact with the Internet, but all software. A big example is Adobe Acrobat Reader (reading offline-transmitted rogue PDF files)
Sep
13
comment Does Skype technology tap a user's machine to route other calls?
Classic non-native-speaker mistake. I believe he was looking for "tap into", which means "use, or take advantage of, or utilize", and not "tap on" which means spy or eavesdrop.
Sep
6
comment Is attempting mySQL injection illegal?
This is highly dependent on the case, the affected party's willingness to press charges, your perceived intentions, the end result of your actions, how big of an #!@%hole the other affected party is, etc. All you need to know is that what you're doing is illegal, and is punishable by law. Only attempt those things on your machine inside on your network. In the UK, you'd be prosecuted under the Computer Misuse Act. The punishment is a minimum of 6 months improvement or a 5k GBP fine.
Sep
1
comment Faster SQL injection prevention
Also, @Shahar, do you have some benchmarks showing the performance impact of parameterized queries?
Sep
1
comment Faster SQL injection prevention
While I'm all for parameterized queries, I'm still interested in seeing a way to exploit the case proposed by the OP.
Sep
1
comment Generate public key from private key
In RSA, and in normal implementations, yes you can.