25,886 reputation
971110
bio website
location Finland
age
visits member for 1 year, 5 months
seen 28 mins ago

I work with security stuff and I enjoy it. You can reach me on: adnan.stackexchange[*at*]live[*dot*]fi


6h
comment How to avoid session sharing inside the same network
"I was thinking about a situation to avoid session sharing or hijacking" ... "someone from inside the same network copied (or hijacked) the cookie to another machine."
6h
comment How to avoid session sharing inside the same network
You can try to use browser fingerprinting techniques, but in the end you're trying to achieve something that isn't possible. You cannot protect against users voluntarily sharing the same cookie in the same network. All of your identifying information are client-supplied.
6h
comment How to avoid session sharing inside the same network
Duh! Which is what you should tell the OP in your answer. Regardless of it being a good advice or not, your answer does not address the question. In this site, we answer questions.
6h
comment How to avoid session sharing inside the same network
This protects from malicious hijacking of the cookie in-the-wire. It doesn't address issues of hijacking from the machine itself, or (as per OP's question) normal copying of the cookie value from one browser to another.
7h
comment Is there a general name for this sort of cryptographic protocol?
@user45218 With that, you're essentially describing an MiTM attack, which is what the whole PKI thing is designed to prevent.
10h
comment what to use as a proxy for desktop applications
I used to use TcpCatcher. PlayCap is also useful for this, and has much more flexibility, but it's not as user-friendly as TcpCatcher.
11h
comment Which hashing algorithm is ideal for use on the web?
possible duplicate of How to securely hash passwords?
Apr
20
comment Length-constant password comparison in scrypt?
@AT My answer on that question applies to Scrypt as well
Apr
16
comment Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
@Lekensteyn There are indeed privacy concerns. Sadly, there's nothing you can do. You either use separate browsers, tolerate the popups, disable client authentication altogether, or simply accept the current situation. Hopefully, this behaviour will be configurable at some point. At least, some addon/extension will help with that. I've edited my answer to include your response.
Apr
16
comment Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
@l0b0 There's nothing else you can do. Firefox will keep popping up asking you choose a certificate as long as the server is requesting one and you have one. Please note that the certificate only contains your public key. If you don't want this to happen, disable the BBC rule in HTTPS Everywhere.
Apr
16
comment Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
Let me guess, the problem disappears when you disable HTTPS Everywhere? (Or just when you disable the BBC option/rule in HTTPS Everywhere)
Apr
10
comment Why did Java (JRE) vulnerabilities peak in 2012-2013?
@ntoskrnl Read from here chat.stackexchange.com/transcript/message/14840511#14840511
Apr
9
comment How can get email about latest vulnerabilities
secunia.com is pretty neat. There are many other services that provide CVE and NVD notifications (Google for that).
Apr
9
comment Which Browsers support TACK?
You said it, this is still a draft. No official server support. No official browser support. Almost nobody is taking this seriously, and that's not just me, that's basically what they're saying about their own project. In my personal opinion, this is a dead/dying project.
Apr
4
comment How many possible combinations in 8 character password?
@Iszi Please note the policy says "at least one of the characters should be...".
Apr
4
comment How many possible combinations in 8 character password?
6.70 x 10^15 possible combinations
Mar
31
comment Hardware-restricted root login
@ScepticalJule An example done with TOTP and PAM. spod.cx/blog/…
Mar
28
comment Is all RSA encryption now considered insecure? (Notably SSH and SSL)
If this is about RSA (the cryptosystem) then this it's too broad and primarily opinion-based (because we can only speculate on what the NSA is really doing). If this is about RSA (the company) then you clearly have no idea what you're asking. The NSA-RSA thing is about their RSA's (the company) PRNGs, and really has nothing to do with SSL/SSH. In any case, we really don't know what the NSA really knows.
Mar
28
comment How to get orignal ip of user even if he is using proxy
Well, you should have asked a a better answer. You wanted to know ways to detect a user's IP. Now you want ways to hide your own IP. Bad question either way.
Mar
28
comment How to get orignal ip of user even if he is using proxy
possible duplicate of Advanced techniques for detecting a proxy/getting original IP and Tracing Proxy Easy or Hard for a Normal Website?