Reputation
1,877
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 7 24
Newest
 Yearling
Impact
~85k people reached

Mar
2
comment Is the action of accepting a pull request on Github vulnerable to race conditions?
As I said in the comments of my answer, this test does not prove that there is no race condition. This test shows that GitHub makes a test before merging the pull request. But what if, Malice's commit is received in the mean time? The delay might be very very short, but this is a race condition. And you said you don't like lucky-based security.
Mar
2
comment Is the action of accepting a pull request on Github vulnerable to race conditions?
I don't want to be obstinated, but you can't make a simple test that proves there is no race condition. If, by chance, you figure out a race condition, then you can say "there is a race condition". However, if you can't figure out any race condition does not mean there is none.
Mar
1
comment Is the action of accepting a pull request on Github vulnerable to race conditions?
If you can't accept a hope, I'm afraid you should directly ask GitHub. I don't think anyone here has access to the source code, as it is proprietary.
Mar
1
comment Is the action of accepting a pull request on Github vulnerable to race conditions?
Maybe "I trust" would be more accurate. I don't have access to GitHub 's source code so I can't do much more.
Aug
1
comment How safe are data you dial to a call center?
Yes you are right, I forgot this. This means I could save my credentials on a recorder to authenticate faster. :D
Aug
1
comment How safe are data you dial to a call center?
Right, in my case I am using a cellphone (which adds the weakness of having to trust the app, but it is not the question). However I am also interested in other phone types.
Jul
25
comment How to generate a superkey to decrypt strings
A public key should be public. If the server is the only one to know the public key, why not using a symmetric key ? Encrypt the message with the server private key is pointless, as everyone should know its public key. By the way, I don't think this answers the question.
Jul
23
comment Get the browser history without using a browser
It depends on the web browser. Best is to ask google (eg. "firefox debian history file"). However the history might be ciphered (or serialized, which makes it hard to read with a simple text editor).
Jul
20
comment Online Shopping password keylogger risk
Security is a matter of trust. The client side of a website can be audited by anybody. So I won't fear any popular website for key logging or malicious actions. Well, not actually, however I would first be aware of the web browser (including plugins) and the operating system. Especially if it is proprietary software... I'm sorry I don't understand what you mean "we can easily catch them using the registered address".
Jul
20
comment How can I identify this hash?
I think the best way to get the hash function is to look for "[linux distribution] passwd hash algorithm" on your favorite search engine. Then good luck to find a dictionary containing this specific hash. If I were you, I would RTFM either to get the root password or to get the way to change it. If this is not possible, the vendor might have a good reason. PS: Basically, uppercase letters are not meant to shout out aggressively.
Jul
20
comment How can I identify this hash?
If this is your router, you should not have to decipher the root password to get full privileges. Moreover, as you say, the password is not encrypted but hashed. The difference is that a hash function is not reversible. So you can't get the original data from the hash, unless you find the correspondence in a dictionary
Jul
19
comment How do NFC tags prevent copying?
As far as I know, a NFC tag is unpowered. So embedding a microprocessor doesn't seem possible.
Jan
11
comment How does an encryption key work?
Could you please give us a bit more details ? What encryption algorithm are you talking about ?
Mar
3
comment Apple ID Created With My Email Address
Could you please detail you answer? If the link you gave gets broken, so get your answer.
Mar
2
comment Automatic robot crawler to check web pages authenticity?
If you get often robbed. Would you buy your properties again and again? Or would you repair your lock?
Mar
2
comment NMAP scan fails
I think the output of nmap could be useful.
Feb
21
comment Is password authentication worse that signed messaging if done over SSL?
"Therefore the server learns the password." Can't the password be hashed by the client, instead of by the server?
Feb
21
comment Is password authentication worse that signed messaging if done over SSL?
Think about encrypting passwords exchange then. And generate strong passwords as well.
Feb
18
comment How is distributed computing security ensured?
I understand that my question might be a bit too broad. I will try to refine it. However I have absolutely no idea of how this is possible and I am pretty stunned that distributed computing with "untrusted machines" works. So I'm looking for an answer that could ease my amazement. Maybe a concrete example?
Jan
18
comment Are passwords stored in memory safe?
You're absolutely right. That's also why I (or at least try to) only run free software my computer.