Next privilege 2,000 Rep.
Edit questions and answers
8 13
~17k people reached

comment How can I safely store a password during a user session
From your description you don't need to store the password, just the tokens returned from the OAuth authentication request. I would recommend re-wording your question, because it is not about passwords, it is about OAuth tokens.
comment Why isn't the arp cache locked for the gateway by default?
But what if the first packet you got back was the MITM pretending to be the gateway and not the gateway itself when you connected, then you would forever trust the MITM and not the gateway.
comment Does Google ensure that a packaged app is not tampered with?
@Nico All app types have a manifest file. See the key attribute in the "Details: The manifest" on the hosted apps page.
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
@Zaibis "I have 10 binary identical smardcard's" And that is where you run in to a problem. The smart cards can't be copied (Without destroying them for finding a flaw in the software running on them) So there is no way to get 10 copies of the card, you will only ever have 1 copy.
comment My ISP is injecting strange codes to every website I visit
You used to see this a bit back in the 90's when there was "free" dialup services (K-mart's "Blue Light" ISP was one I personally remember using and saw doing this). They did code injection to put their banners on every page.
comment Security Implications of using Base64 Encoding with Encryption
@prmph so your question really is about "is it ok to feed in a base64 string in to PKBDF2"
comment Can my workplace view my Tor traffic?
@simonzack I have never seen a place that is security conscious and allows BYOD with sensitive information on the network. BYOD is fine if you have a "public" network people connect to, but that network should not have any open access to sensitive customer information (to access sensitive info you go through a DPI firewall or use a secure app ect.). But that setup is the exact situation Ben was talking about in the "If you have permission" section where using Tor is fine as it is a "public" network.
comment Windows DLL Injection
@Clockwork-Muse You really should post that as an answer, I would upvote it.
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 That is because twitter uses HSTS so your browser automatically goes to the HTTPS version. So after you visit the page once the browser stops checking the HTTP version, but it still must connect with HTTP the very first time (unless the browser vendor includes twitter as flagged as HSTS "out of the box" which is very possible).
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 no it's not, even for services only available via https you either need to enter a url by hand or click a link, if you do not explicitly add the HTTPS by hand or the source of the clicked link was HTTP then SSL Strip is very relevant.
comment Does an established SSL connection mean a line is really secure?
"Software such as Firefox and Chrome needs to be updated differently." Both of those software's can have certificates deployed via GPO also but the IT administration needs to make special GPO rules to make it happen, so it is not that it can't happen it just takes extra steps on the part of IT.
comment Allow access only for some Mac Ids
@user93353 Nothing, but they have to have access to the machine to clone it. You don't need access to the source machine to clone a MAC address, just observe it's existence on the network.
comment Allow access only for some Mac Ids
To give a real world analogy of the problem: Imagine you own a club that only lets people named Scott in, if when Mr. Deters here tries to go in he just says his name is Scott Chamberlain the bouncer at the door will happily let him in. You have no way of verifying the identity of a MAC address the computer gave you is the real address. Now if the bouncer asked for some form of ID from a trusted 3rd party that you knew would not give out fake IDs (client certificates) then the problem would be solved.
comment Encryption and Deniability
Just to be sure, You don't care that you can prove Alice had K in her position at some point? If K is random and not reused, in most places that is enough "evidence" that Alice did send the message.
comment How does hashing work?
@Griffin It prevents the re-use of work. If two users use the same password and you don't have a salt it will produce the same hash. If an attacker cracks one users password by correctly guessing it he now has all of the users passwords who used that same password. By adding a random salt per user it makes the attacker unable to re-use his guesses he made for a previous user on the next user.
comment Transmission of messages
That is the point of the secure link, if you use something like SSL correctly (checking that the cert you receive from the server is the cert you expected to see) it can't be intercepted.
comment Transmitting malicious code over audio speakers
You are right, I have removed the claim.
comment Totally secure public key distrubition
You just say "a CA" can be subverted are you ruling out ALL solutions that involve a 3rd party (for example a "Web of Trust", or a private CA)?
comment Do the Windows shared source files compile into the same binaries as the retail version?
One big thing that will not be in ANY code sharing database will be the private keys to sign the files. Most of the "important" DLL's in windows (ntdll.dll, clfs.dll, ect...) are all digitally signed and there is no way to re-create that without the keys from Microsoft.
comment How do I mitigate a MITM on https?
I find that not as likely (I don't see a reason they would store the start time) however I very easily could see a math bug for calculating the correct time zone offset.