Reputation
1,513
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 18
Newest
 Good Answer
Impact
~40k people reached

Apr
21
comment What version of TLS does any web browser use when connecting to server where all SSL Protocols are enabled?
Just as an update, but it turns out there are several possible attacks on SSL/TLS using downgrade during handshake, and nowadays if you want your server to be considered reasonably secure you configure it to reject handshake downgrading.
Apr
16
comment Can or should whitelisting replace encryption?
Replace, no. Augment, absolutely.
Mar
11
comment Why would an encrypted file be ~35% larger than an unencrypted one?
It's a bit of ass covering combined with worst-case assumption. "Any encrypted file can be up to 35% larger than the original."
Mar
7
comment Can a brute force attack be certainly prevented on a unix/linux shell?
Also, consider things like fail2ban and the fact that pam_login defaults to a two-second delay before replying 'login incorrect'. It doesn't matter how fast your hardware is is you're only allowed one attempt every two seconds and a five minute lockout after three failures.
Feb
25
comment If multiple users on the same website all use the same password, is their password hash the same?
Not unless the site has been dangerously negligent with their security and doesn't use random salts. In which case you have bigger problems.
Feb
10
comment Can I read the domain name from HTTPS before SSL handshake?
At this point, if you're still using a client too old to understand SNI, not getting HTTPS properly is the least of your problems.
Jan
27
comment How can changing your DNS protect your online privacy?
Hogwash. DNS requests are plaintext and UDP. If your ISP is acting in bad faith they can intercept DNS requests going to a different resolver just as easily as requests going to their own.
Jan
26
comment How can changing your DNS protect your online privacy?
The only way this could work is if they have a http proxy as well as a dns server -- and even then it wouldn't stop your ISP from seeing what you're doing. This is almost certainly a con.
Jan
9
comment How to know whether a textfile has been edited or tampered with?
@philipp is correct - at best, this is "security by obscurity" and it's no protection at all against anyone with rudimentary knowledge, a hex editor and a modicum of patience.
Nov
20
comment How does the hacker manage to spoof a different IP address?
Doesn't need to be their own router -- theoretically, any router in between the target's computer and the address segment they're trying to spoof would suffice.
Nov
20
revised Can I use port 443 without SSL?
No SSL == No encryption. That statement made zero sense.
Nov
20
suggested approved edit on Can I use port 443 without SSL?
Oct
28
comment HSTS on sites available over HTTP and HTTPS
A user with broken HTTPS should probably install a browser with working HTTPS instead... But maybe that's just me being unreasonable.
Oct
15
answered How can one execute code upon entry of folder in Windows?
Oct
9
awarded  Good Answer
Oct
2
comment How do DoS attacks work on non-servers?
The computer in question still has to process the traffic, even if it's only to say "nothing listening in this port, sorry".
Sep
21
comment Should I password protect all my archives from cloud?
@CommuSoft "It's not that I don't trust you; it's that I don't trust anyone."
Aug
25
comment Is a server infrastructure fundamentally possible which the smartest person can't breach?
@jonathantodd In fact, your original comment makes the 0days worse because now you have no way of getting to the computer to fix them after they're discovered.
Aug
25
comment Is a server infrastructure fundamentally possible which the smartest person can't breach?
@JonathanTodd Let me save you a great deal of effort then: The answer is "No." As long as there will be humans who should be able to access the data, there'll be a loophole to exploit for humans who shouldn't.
Jun
30
comment How secure is Snowden's MargaretThatcheris110%SEXY password?
It may be a known algorithm now, but the key space of "a relatively short English sentence that may or may not make sense" is one hell of a large key space to attempt to bruteforce. PGP/GPG isn't any less secure just because people know how it's calculated.