Reputation
26,404
Next tag badge:
100/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

Feb
25
revised Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?
added 9 characters in body
Feb
25
answered Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?
Feb
25
comment Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?
<noscript> displays special content when javascript (or scripting language inside instead of usual text/javascript in <script type="text/javascript">) is turned off or not supported by the browser. It has nothing to do with stopping XSS. Maybe there was a draft proposal for <noscript> to work differently at some point, but the html element that exists works in this way: developer.mozilla.org/en-US/docs/Web/HTML/Element/noscript
Feb
24
comment Different IPv4 numbers from different browsers, same computer
Are you using any sort of network proxy in one of the browsers but not the other? Also try disabling your browser extensions as some (such as Hola) can be used to set up such a network proxy.
Feb
22
comment Why should one bother encrypting the harddisk in linux if one can easily recover the root password?
@mti2935 - While man crypt calls its sha256 / sha512, as Gilles said it is really sha256crypt / sha512crypt which basically does 5000 (by default) rounds of sha256 / sha512. See: akkadia.org/drepper/SHA-crypt.txt or pythonhosted.org/passlib/lib/passlib.hash.sha256_crypt.html
Feb
22
comment Is Entropy all that matters in a Password?
However a password like FootballPractice or FootbalPractic is still incredibly weak (two random words chosen from a reasonable sized dictionary generally have ~13 bits of entropy), so at best FootballPractice would be originally be say 26 bit words, except the phrase is meaningful and likely not random, so its much lower entropy less than this. Even if you added say ~6 bits of entropy by truncating letters, it's still within the regime of online brute-force attacks. A password's entropy is the base-2 logarithm of the number of possible passwords it was chosen from.
Feb
22
comment Is Entropy all that matters in a Password?
While longer passwords tend to have higher entropy its not always true -- it depends on the mechanism used to generate the password. E.g., choosing a common 8-character password like password (takes up 8 bytes in ASCII) has a very low entropy you could find this on a list of the top 16 passwords so about 4 bits of entropy (2^4 = 16). Meanwhile Bx.hC&V a 7-char password generated by randomly selecting one of 94 printable characters (97^7 = 64847759419264 ≈ 2^45.9 ) has about 45.9 bits of entropy. Modifying words in your passphrase by truncating a letter adds a couple bits of entropy.
Feb
18
comment Using emoticons in passwords
Not sure how you got 68 printable characters. There are 26 character keys, 10 numbers, and 11 ASCII symbol keys (,./;'[]\-= plus backtick), (26+10+11=47) all of which can be shifted for 94 characters and there's also space (which can't be shifted). Hence 95 printable ASCII characters (though occasionally there's some discrepancy whether characters such as linebreaks or tabs should be counted as printable or not).
Feb
18
comment How much more difficult does it become to crack a password when appending a 5-digit pin?
Appending a 5 digit number to the end of a password adds log₂(100000) ≃ 16.6 bits of entropy. To prevent even sophisticated off-line brute force attacks is have the entropy of your password generation process should be more than ~80 bits (equal to 38 million computers trying a password every nanosecond for a year). Assuming no underlying flaws like keyloggers or reusing the same passwords at multiple sites (even just once typing password at an evil site), or can't be bribed or threatened to give the pw up for much less than the electricity bill for a year of 38M computers.
Feb
18
comment How to decrypt this javascript code
@cremefraiche - Javascript obfuscation is very much a information security concern. Sure this particular question/code isn't particularly enlightening (no idea what muka.open does), but the basic gist of how to understand and translate obfuscated JS is worth understanding for anyone interested in the security of their JS-enabled browser.
Feb
18
revised How to decrypt this javascript code
added 704 characters in body
Feb
18
revised How to decrypt this javascript code
added 704 characters in body
Feb
18
revised How to decrypt this javascript code
added 50 characters in body
Feb
18
answered How to decrypt this javascript code
Feb
17
comment Safari not showing GREEN lettering for EV SSL
Try running the Qualys ssl test ( ssllabs.com/ssltest ) to see if there's any potential issues with your certificate/deployment that Safari is picking up on.
Feb
17
awarded  Nice Answer
Feb
17
answered Using emoticons in passwords
Feb
15
comment DOM Based XSS attacks: what is the most dangerous example?
@ForguesR - No, if the webpage is poorly designed with flaws like document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("defau‌​lt=")+8)+"</OPTION>");, and an attacker can trick a user to click their link (with a malicious <script>), then the attack works even with strong authentication. (That is user clicks malicious link, authenticates with the website, and then the javascript executes in the background sending information to the attacker; e.g., if the attacker has a separate server listening for secret info to be sent to them via javascript).
Feb
7
awarded  Nice Answer
Jan
31
comment chrome red lock icon this page includes other resources which are not secure these resources can be viewd by others while in transit
@dave_thompson_085 - Yes. Sorry my answer was condensed and a tad unclear from being forced to be comments. Being vulnerable to POODLE TLS is a flaw in the webserver (patchable); supporting PFS and using good protocols (not SSLv3) and ciphers is a server config issue (might require webserver upgrade). By the way, NIST deprecated SHA1 for digital signatures in Jan 2011 and disallowed after 2013 (pdf). However, it was still often used as some outdated browsers (e.g., IE6-8 on XP before SP3) didn't support SHA-2 signatures.