1,000 reputation
411
bio website
location Oshkosh, WI
age 30
visits member for 3 years, 5 months
seen Sep 18 at 21:37
Software developer.

Aug
13
comment Can my workplace view my Tor traffic?
@simonzack I have never seen a place that is security conscious and allows BYOD with sensitive information on the network. BYOD is fine if you have a "public" network people connect to, but that network should not have any open access to sensitive customer information (to access sensitive info you go through a DPI firewall or use a secure app ect.). But that setup is the exact situation Ben was talking about in the "If you have permission" section where using Tor is fine as it is a "public" network.
Mar
31
comment Windows DLL Injection
@Clockwork-Muse You really should post that as an answer, I would upvote it.
Mar
27
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 That is because twitter uses HSTS so your browser automatically goes to the HTTPS version. So after you visit the page once the browser stops checking the HTTP version, but it still must connect with HTTP the very first time (unless the browser vendor includes twitter as flagged as HSTS "out of the box" which is very possible).
Mar
27
comment If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?
@user2675345 no it's not, even for services only available via https you either need to enter a url by hand or click a link, if you do not explicitly add the HTTPS by hand or the source of the clicked link was HTTP then SSL Strip is very relevant.
Mar
26
comment Does an established ssl connection mean a line is really secure
"Software such as Firefox and Chrome needs to be updated differently." Both of those software's can have certificates deployed via GPO also but the IT administration needs to make special GPO rules to make it happen, so it is not that it can't happen it just takes extra steps on the part of IT.
Feb
17
comment Allow access only for some Mac Ids
@user93353 Nothing, but they have to have access to the machine to clone it. You don't need access to the source machine to clone a MAC address, just observe it's existence on the network.
Feb
16
comment Allow access only for some Mac Ids
To give a real world analogy of the problem: Imagine you own a club that only lets people named Scott in, if when Mr. Deters here tries to go in he just says his name is Scott Chamberlain the bouncer at the door will happily let him in. You have no way of verifying the identity of a MAC address the computer gave you is the real address. Now if the bouncer asked for some form of ID from a trusted 3rd party that you knew would not give out fake IDs (client certificates) then the problem would be solved.
Jan
29
comment Encryption and Deniability
Just to be sure, You don't care that you can prove Alice had K in her position at some point? If K is random and not reused, in most places that is enough "evidence" that Alice did send the message.
Nov
17
comment How does hashing work?
@Griffin It prevents the re-use of work. If two users use the same password and you don't have a salt it will produce the same hash. If an attacker cracks one users password by correctly guessing it he now has all of the users passwords who used that same password. By adding a random salt per user it makes the attacker unable to re-use his guesses he made for a previous user on the next user.
Nov
15
comment Transmission of messages
That is the point of the secure link, if you use something like SSL correctly (checking that the cert you receive from the server is the cert you expected to see) it can't be intercepted.
Nov
4
comment Transmitting malicious code over audio speakers
You are right, I have removed the claim.
Oct
9
comment Totally secure public key distrubition
You just say "a CA" can be subverted are you ruling out ALL solutions that involve a 3rd party (for example a "Web of Trust", or a private CA)?
Sep
11
comment Do the Windows shared source files compile into the same binaries as the retail version?
One big thing that will not be in ANY code sharing database will be the private keys to sign the files. Most of the "important" DLL's in windows (ntdll.dll, clfs.dll, ect...) are all digitally signed and there is no way to re-create that without the keys from Microsoft.
Aug
30
comment How do I mitigate a MITM on https?
I find that not as likely (I don't see a reason they would store the start time) however I very easily could see a math bug for calculating the correct time zone offset.
Aug
30
comment How do I mitigate a MITM on https?
I think you where close, Look at the "Not valid before" time, I think he connected too early (or at least his machine thought it was too early) for the certificate to be valid.
Aug
27
comment Man in the middle attack still possible against ssl?
You may want to add something about Strict Transport Security as a countermeasure too.
Aug
2
comment Why would one increment card security code for a new payment card
@NathanC Heck no, stay away from the lottery for the rest of your life! You used up your one lucky chance you get already.
Jul
18
comment Can I avoid DNS spoofing by typing the IP address?
A good example of this, go ping security.stackexcange.com and you will likely get the ip 198.252.206.16, but if you visit that IP, you do not get this website.
Jun
23
comment Why can a Tor exit node decrypt data, but not the entry node?
@bonsaiviking Ahh, I see. You are the first person ever to be able to explain that. So its Me<--(TCP connection 1)-->Tor Entry point<--(Tor Protocol Stream)-->Tor Server<--(Tor Protocol Stream)-->Tor Server<--(Tor Protocol Stream)->Tor Exit Point<--(TCP connection 2)-->Destination Server So I only have a TCP connection to the entry point and the final destination only has a TCP connection to the exit point.
Jun
21
comment Routable Domain for DC?
To see a related topic to what Gordan talked about, see this old quetsion of mine.