Reputation
Next privilege 125 Rep.
Vote down
Badges
6
Impact
0 people reached

Mar
1
comment What is DROWN and how does it work?
Also note that there are circumstances in the paper under which you can do a "Special DROWN" attack that takes ~1 minute on a single CPU core.
Feb
12
comment Script Kiddies - how do they find my server IP?
To find all Digital Ocean IPs, you just need to check the AS number listings. You want to look at AS14061 Digital Ocean, Inc..
Dec
16
comment Should I worry about a breach where my password was not revealed?
Okay, so GIVEN: encrypted bcrypt hashes were stolen, but the encryption key was definitely not available for the given means of attack; AND: no other password leakage occurred; THEN: It is not practical to extract user passwords.
Dec
15
comment Are reCAPTCHA enough to prevent brute-force password guesses?
I generally prefer application-level ratelimiting to TCP throttling, especially if your server is using h2 - you can send an unlimited number of concurrent requests over one TCP connection.
Nov
17
comment Preventing registered users from sharing passwords
Also, if the website is accessed from school computers, all the computers are going to look exactly the same.
Sep
2
comment Best way to scan for and eliminate earlier versions of SSL/TLS in a production environment
Note that modern browsers will include the TLS_DOWNGRADE_SCSV in their cipher suite in response to a downgrade attack; but it is not widely used for non-browser programs.
Sep
1
comment download file/folder anonymously on a ssh session
Be aware that SSH will try all public keys first for authentication, which can blow your identity. Authentication and privacy are pretty hard to get together.
Jul
30
awarded  Autobiographer
Jul
27
comment Do these regex show that I was hacked?
@OldCastle In this case, I don't think you should be worrying about that anymore. Worry about the nuke & pave operation.
May
16
awarded  Commentator
May
16
comment Ensure that a file can only be decrypted after a specific date
This is a case for genuine "key escrow", and it operates in a similar way to normal escrow... Encrypt a file with a symmetric key, give the key to an escrow firm along with the fee, destroy your copy, they release the key at X date.
Mar
22
comment A person knows my IP address: how to save my data and address?
@Kousha Well, technically that should be their load balancer, and dig yahoo.com (unix) wouldn't bother to send them any data...
Feb
5
comment I can't access websites that use HTTPS, instead getting the message “your connection is not private”!
@Roy Could you post the certificate fingerprint of the certificate they asked you to install? Thanks.
Nov
25
comment What makes it difficult to have a hardware antivirus?
@Falco That's still an unacceptable solution for consumer machines that need to compile code. And, of course, if you start inspecting uncompiled code for malware, I'd like to hear your solution to the halting problem.
Nov
10
comment Differences between using Tor browser and VPN
@cpast Unless, of course, you transmit PII (personally identifiable information) over Tor, in which case the exit node can log that. For example, all BitTorrent traffic contains your IP address. Several exit nodes will log any HTTP form data with a field named password.
Nov
2
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
@Peteris Which, coincidentally, happens to be something very desirable to malware writers.
Oct
17
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
But doing anything on the certificate level would be too inflexible to indicate whether the backend connection is plain, SSL Self-signed, or full proper SSL. (Those are the three options they give you.)
Oct
9
comment Is it safe to reveal information about the OS and the software you use?
Again, it depends on your threat model. ATMs handle their threat model of a physically present person by restricting access to the computer, and restricting the available inputs it presents to the user.
Mar
16
comment What does this sh script do if executed?
I think the idea behind killing sh is that it's trying to kick you off if you're remoted into the system.
Mar
2
comment WEP > WPA? Why?
The original Nintendo DS is one of those devices. Was pretty annoying for me.