Reputation
24,868
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
4 51 115
Newest
 Nice Answer
Impact
~1.7m people reached

Feb
7
awarded  Nice Answer
Jan
31
comment chrome red lock icon this page includes other resources which are not secure these resources can be viewd by others while in transit
@dave_thompson_085 - Yes. Sorry my answer was condensed and a tad unclear from being forced to be comments. Being vulnerable to POODLE TLS is a flaw in the webserver (patchable); supporting PFS and using good protocols (not SSLv3) and ciphers is a server config issue (might require webserver upgrade). By the way, NIST deprecated SHA1 for digital signatures in Jan 2011 and disallowed after 2013 (pdf). However, it was still often used as some outdated browsers (e.g., IE6-8 on XP before SP3) didn't support SHA-2 signatures.
Jan
30
comment chrome red lock icon this page includes other resources which are not secure these resources can be viewd by others while in transit
The problem with SHA-1 signatures is that with the advent of data centers and increase in computing power (along with work finding flaws in SHA-1 design), very sophisticated attackers with access to lots of computing power in principle can with much effort create SHA-1 collisions (or should be able to in the near future) which would allow them to do man-in-the-middle attacks (and steal your information). Forward secrecy is a good property to have, but not having it doesn't mean your connection can be eavesdropped or tampered with.
Jan
30
comment chrome red lock icon this page includes other resources which are not secure these resources can be viewd by others while in transit
uk.cricut.com needs to update their certificates as their current deployment has several attackable vulnerabilities (POODLE, POODLE TLS, maybe FREAK, doesn't support forward secrecy). They need to upgrade and patch their webserver to support TLS 1.2 and prevent POODLE TLS, stop using SHA-1 signatures, support forward secrecy, and stop supporting obsolete outdated ciphers. Granted, most likely the web site is still safe. POODLE attacks require attackers to insert malicious javascript into clients.
Jan
30
awarded  Enlightened
Jan
29
awarded  Nice Answer
Jan
29
comment Is random URL token secure enough for file attachments and other user content?
@SteveDL And sure my email provider or gov't can probably read my emails getting these secret links. But still example.com where I've uploaded the file can see my file and provide them to the gov't when requested even if I maintain strict access control. And for things like say family pictures, the token in the URL makes it much easier to email the pics to some family members and let those family members share the link to the album to people you may have forgotten (without having to request access) or having the family member download the images to share them with the person you forgot.
Jan
29
comment Is random URL token secure enough for file attachments and other user content?
@SteveDL This question was random tokens in a URL for file attachments to private messages. If I want to send friends a link to a 100MB video file/photo album that I'd otherwise include as an email attachment, but instead provide an access link at https://example.com/private/<random token> (with a robots.txt telling search engines to never index /private/ and the random token appears after that) this is as secure as an attachment. Yes, a malicious friend could share the link with other people who I haven't given access, but with any scheme they can download the file and upload it elsewhere.
Jan
29
comment Is random URL token secure enough for file attachments and other user content?
@SteveDL Your duplicate question asked a different question. That question was about having all content served from one obscurely named directory that then hosts all the content. The reason that doesn't work is the same reason all paying subscribers to the Wall St Journal shouldn't just be given the same password for simplicity. The password would leak. See the answers to this very similar question ( security.stackexchange.com/questions/36870/… ), where the answers agree it is not security by obscurity.
Jan
28
revised Is random URL token secure enough for file attachments and other user content?
added 527 characters in body
Jan
28
answered Is random URL token secure enough for file attachments and other user content?
Jan
28
comment Is random URL token secure enough for file attachments and other user content?
Use of random tokens is not security by obscurity. Security by obscurity is when security is lost if the implementation details (e.g., source code, algorithm) become available to the attacker. This contrasts with security by design where the implementation can be publicly known and only secret keys (passwords, random tokens, private keys) have to be kept secret. In this case the secret key is the randomly generated token. Of course, this fails if the secrets are leaked.
Jan
27
revised Why did customer services say using symbols in a password is insecure?
added 564 characters in body
Jan
27
awarded  Nice Answer
Jan
26
answered Why did customer services say using symbols in a password is insecure?
Jan
26
awarded  Enlightened
Jan
26
awarded  Nice Answer
Jan
21
comment Is reading from prod to dev a security concern?
Is the copied data secret or confidential in any way? If so, copying it out of a locked down environment to a looser dev environment does create the opportunity for that information to leak out (due to any temporary flaws in the dev environment).
Jan
13
comment Is it possible for my password to have more than one password combination?
@A.L - I'm going to keep using tilde for approximately. It's a common succinct notation ( en.wikipedia.org/wiki/Tilde#Common_use ) for "approximately" (as a unary operator; e.g., about ~7 billion humans) or "approximately equal" (as a binary operator e.g., 2^10 ~ 10^3) and my answers already tend to be on the long side. I'd rather just explain this notation to people unfamiliar with it if they ask.
Jan
13
comment Is it possible for my password to have more than one password combination?
@aross - It had two bad features; (1) password in plaintext/reversible encryption (forgot password features should require you to validate yourself and then set a new password), and (2) stripping out special characters from your password drastically weakens it. Take OP's pw !78ghA,NJ58*#3&* - 16 chars randomly chosen from 96 printable ASCII chars : ~105.4 bits of entropy (52040292466647269602037015248896 pws) - very secure. Stripping special chars makes it 59.5 bits (839299365868340224 pws) - much less secure. If numbers were also stripped its 28.5 bits (380,204,032 pws) - very weak.