1,010 reputation
412
bio website
location Oshkosh, WI
age 30
visits member for 3 years, 6 months
seen 2 days ago
Software developer.

2d
comment Security Implications of using Base64 Encoding with Encryption
@prmph so your question really is about "is it ok to feed in a base64 string in to PKBDF2"
Sep
24
awarded  Autobiographer
Aug
13
comment Can my workplace view my Tor traffic?
@simonzack I have never seen a place that is security conscious and allows BYOD with sensitive information on the network. BYOD is fine if you have a "public" network people connect to, but that network should not have any open access to sensitive customer information (to access sensitive info you go through a DPI firewall or use a secure app ect.). But that setup is the exact situation Ben was talking about in the "If you have permission" section where using Tor is fine as it is a "public" network.
Apr
26
awarded  Yearling
Mar
31
comment Windows DLL Injection
@Clockwork-Muse You really should post that as an answer, I would upvote it.
Mar
29
revised If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
added 49 characters in body
Mar
27
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 That is because twitter uses HSTS so your browser automatically goes to the HTTPS version. So after you visit the page once the browser stops checking the HTTP version, but it still must connect with HTTP the very first time (unless the browser vendor includes twitter as flagged as HSTS "out of the box" which is very possible).
Mar
27
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 no it's not, even for services only available via https you either need to enter a url by hand or click a link, if you do not explicitly add the HTTPS by hand or the source of the clicked link was HTTP then SSL Strip is very relevant.
Mar
26
comment Does an established ssl connection mean a line is really secure
"Software such as Firefox and Chrome needs to be updated differently." Both of those software's can have certificates deployed via GPO also but the IT administration needs to make special GPO rules to make it happen, so it is not that it can't happen it just takes extra steps on the part of IT.
Mar
26
revised If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
added 47 characters in body
Mar
26
answered If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
Feb
17
comment Allow access only for some Mac Ids
@user93353 Nothing, but they have to have access to the machine to clone it. You don't need access to the source machine to clone a MAC address, just observe it's existence on the network.
Feb
16
comment Allow access only for some Mac Ids
To give a real world analogy of the problem: Imagine you own a club that only lets people named Scott in, if when Mr. Deters here tries to go in he just says his name is Scott Chamberlain the bouncer at the door will happily let him in. You have no way of verifying the identity of a MAC address the computer gave you is the real address. Now if the bouncer asked for some form of ID from a trusted 3rd party that you knew would not give out fake IDs (client certificates) then the problem would be solved.
Jan
29
comment Encryption and Deniability
Just to be sure, You don't care that you can prove Alice had K in her position at some point? If K is random and not reused, in most places that is enough "evidence" that Alice did send the message.
Dec
6
revised Does a simple mobile REST API need HTTPS?
added 115 characters in body
Dec
6
answered Does a simple mobile REST API need HTTPS?
Nov
17
comment How does hashing work?
@Griffin It prevents the re-use of work. If two users use the same password and you don't have a salt it will produce the same hash. If an attacker cracks one users password by correctly guessing it he now has all of the users passwords who used that same password. By adding a random salt per user it makes the attacker unable to re-use his guesses he made for a previous user on the next user.
Nov
15
comment Transmission of messages
That is the point of the secure link, if you use something like SSL correctly (checking that the cert you receive from the server is the cert you expected to see) it can't be intercepted.
Nov
14
revised Transmission of messages
added 1 characters in body
Nov
14
answered Transmission of messages