197 reputation
8
bio website
location
age
visits member for 1 year, 8 months
seen Oct 3 at 13:12

Jun
23
answered Port Knocking using only Iptables/netfilter
Mar
31
awarded  Student
Feb
28
awarded  Scholar
Feb
28
accepted Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?
Feb
28
asked Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?
Oct
1
comment Google Calendar has events that I didn't create and it's not shared
If you open the event, you can see what calendar it came from, which identifies the sender. You can also mark as spam from within the event detail.
Sep
27
answered Google Calendar has events that I didn't create and it's not shared
Jun
12
awarded  Citizen Patrol
Jun
11
awarded  Editor
Jun
11
revised Are different top level domains somehow different security wise?
Added note on registrar requirements
Jun
11
answered Are different top level domains somehow different security wise?
Jun
11
comment Does Windows keep an Active Directory user token while locked?
If you run it in the lab, let us know. I'm curious. The particulars of access token refresh are poorly documented, even in the sysinternals stuff.
Jun
10
awarded  Commentator
Jun
10
comment Is any company or group working on secure hardware architectures?
Re: #2, You may want to look at formal verification en.wikipedia.org/wiki/Formal_verification of OSs.
Jun
10
comment Does Windows keep an Active Directory user token while locked?
I don't have a test lab set up to run Inception, but the trivial case to test this is can you run a new network process or create a new connection once you run inception. Reviewing the literature on MS access tokens ( msdn.microsoft.com/en-us/library/windows/desktop/… ) my suspicion is that even if the network tokens went bad, they're really just impersonation tokens, so they'd just be renewed using the primary token for the user.
Jun
10
comment Login system using authenticated encryption without storing user password
I see how it could be read that way. I suppose I had a much less charitable reading of how the asker was implementing this.
Jun
10
answered Login system using authenticated encryption without storing user password
Jun
9
comment Who can view my https browsing habbits?
To directly answer, no. They'll know you're talking to Google, but not what you're talking about (unless you click through on google to an insecure site and your referrer field leaks info). However, if your browsing information is being collected under warrant all bets are off.
Jun
9
answered Who can view my https browsing habbits?
Jun
8
comment Can botnets be injected through open wifi to smartphones?
I really don't want to keep up the back and forth (feel free to have the last word), but you're still focusing on javascript and phishing as vectors for infecting. A rogue AP is the single best way to be in a position to conduct any attack that relies on stack or heap manipulation on a client service. It allows you to become a malicious peer on any connection from the device. I repeat, to say a rogue AP lets you achieve the same things as phishing emails or compromised websites is a misrepresentation of the risk they present.