476 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 5 months
seen yesterday

Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
Okay, sorry, I thought that you were referring to bank cards, where it was your bank balance that was saved. In that case, absolutely not (the card wouldn't know about online transactions, for example). Otherwise, yes, the card is loaded with money, and the crypto capabilities prevent tampering. This is effectively holding cash, just stored on a card. The system may not even keep track of the balance on each card, just aggregate transaction amounts for each register. No terminal maintains a db of all balances on all cards, only maybe what it's processed.
Dec
2
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
You don't store the balance on the card itself, for exactly that reason. These cards have encryption capabilities to help prevent fraud by stealing the card, but this is generally to protect individual consumers, not processors. Terminals that process Debit transactions almost always are hooked up with a realtime connection (to an ACH or the bank itself), specifically to mitigate these types of attacks - on older systems, this was the only way to verify the pin! Used for Credit they might not be, but you'd still be on the hook, so...
Dec
1
comment Can bankers' rounding be exploited to maliciously increase balances?
@Falco - Hrm, you're right. Seems I misread it. (<is now trying to figure out why he first thought that>)
Nov
29
comment Secure private key storage
In that case, you'd still be plugging a compromised USB drive into your machine - badusb itself isn't a requirement. So existing attacks should still work just fine (ie, Stuxnext didn't need it to do its work). badusb is really more about how firmware isn't properly protected, meaning you have some extra ways to hide/attack... but you still have to hit the USB key in the first place.
Nov
29
comment Techniques to make a login page safe without using SSL
Stealing a login is the least they could do. MiTM means they can do just about anything - replace the data sent to your server, replace the data coming from your server... if you leak the Facebook login somehow I imagine people will be very annoyed with you. For your number 3, you're probably sending things as a GET request instead of a POST request (which you're not supposed to do for exactly this reason).
Nov
25
comment Can a lock picker slowly undermine the security of a deadbolt door?
Forget being defeated through lockpicking, if I considered the information valuable enough I'd just buy (make?) a batch of explosives. Or, depending on the door, a chainsaw. It'd be really obvious (and likely to alert somebody), but ideally I could just grab the machine and run within a minute.
Nov
22
comment Virus Folder named “Photo”
If you're on Windows, that has several "virtual folders" which searches for and displays relevant files (Photos, Music, Videos, etc). It may very well be attempting to access remote drives, etc. Might this be what's happening in your case? You can attempt to use some other tools (things like Malwarebytes) to see if that's the case, but the major recommendation is often to reformat the whole computer...
Nov
4
comment OpenVPN detection
@greasemonkey - That question was asked a week ago. Why are you asking? One major factor in using VPNs is to disguise the origin location, both from the ultimate destination and anybody else snooping on the line - if you could detect the true location it would defeat the purpose. Further, just knowing that something is running a VPN service isn't necessarily enough to tell you that a given connection is using the service, vs coming from the computer running the VPN itself.
Oct
31
comment Can anyone be hacked?
If they just want some information from you, attacks can be as little as $5. As usual, the weakest element of the security chain isn't the technology, it's the humans around it.
Oct
31
comment What stops a developer from accessing credit card details and other secret data from a company
@AyeshK - Depending on the amounts involved, and how much it would cost to implement/for compliance/in the case of breaches, you may have better luck using one of the existing payment processors (like PayPal or Amazon's). They manage all this stuff for you, for a fee. Dealing with stuff of this nature is non-trivial, and people are becoming more wary (given the number of breaches occurring).
Oct
29
comment How can I detect a VPN connection (even just in some cases) to get the real location of the user
People concerned about their privacy (for whatever reason) are going to be annoyed at you. Comparing local/server time isn't going to work - so long as NTP is on you'd have roughly the same UTC time, but "local time" (displayed) can be whatever you want it to. What happens if I sign up on vacation in your target timezone? What about when I go back home? What happens if I sign up while flying on an airplane (no DNS entry for middle-of-the-ocean...)?
Oct
26
comment All users can write only one can read system
Again, if you're going to all the trouble of maintaining all this for somebody else (most people don't know how to deal with encryption keys), just make it so that they have read permissions in your application. You don't really need to encrypt anything at that point (even if you should for the data at rest), because the unauthorized people literally have no (legitimate) way to get the data. It's actually better than handing them encrypted records, too. If they have a illegitimate way to get the data, I'd expect they'd have a way to get non-encrypted records anyways...
Oct
26
comment All users can write only one can read system
...If you're just inserting this in a db, why not just design your API (or your website) so that sellers just don't get to see what they inserted? Note that you have to do something akin to this anyways, just to keep them from reading what they just did... You can encrypt the db if you need to (most major ones have built-in facilities for this). I have to ask, though, what kind of data are you inserting, that sellers shouldn't be able to read it? If Credit Card numbers, you probably want a system that logs reads of the sensitive info (likely do anyways).
Oct
24
comment Why require new users to change password?
@sebastiannielsen - I don't know much about those setups, but presumably actions undertaken that way are at least logged. Heck, even base desktop support may have remote control facilities, who are probably trusted far less than any admins (at minimum, every person you add increases the risk of one of them doing something undesirable).
Oct
24
comment 1'or'1'='1 help
Given that 'anything (' would (assuming it escaped the variable replacement) cause a syntax error, you need to add more Boolean checks. Personally, I'd probably swap out the ` or '1' = '1'` check for something that uses the desired username...
Oct
17
comment How can one verify that two separate emails are not coming from the same place?
Even if they do come from the same person, why does it matter? Granted, buying something from two different accounts is unusual, but not unreasonable - what about a business versus personal purchase, from two differently purposed accounts? Or for two different lines of business or something? What is it you plan on doing if it is the same person? Your customer may have a right to complain if you deny him just because he's using two different accounts...
Oct
12
comment Privacy of Image search with https
If nothing else, the mitigation steps required to make your requests private are going to look really suspicious. They may even violate one or more employee agreements you may have signed. And if you spend too much time looking at whatever those images are, you can still be called to account for wasting time at work. If there's an information breach from an insider, and they can't find any other obvious routes out, you're going to look really good for it...
Sep
20
comment Password stolen on public wifi even though https was used
Could be that he was executing a MiTM attack, and either the device didn't fully validate the certificate, or the user ignored the warnings it generated...
Sep
9
comment Is it possible to find CryptoKey from orginal password and hashed password?
Well, you could manually try brute forcing the key (and, if the op had a list of "remembered possible" passwords, that's what they would be), but it'd take a while....
Sep
7
comment Storing a user's password in a retrievable manner
Personally, I think I'd probably set up a separate server (physical or virtual instance, whatever), then have a service that takes input and encrypts/decrypts it (internal only, obviously). That is, don't put the public/private keys with the rest of your data. This would probably remove the need to encrypt with a per-user key or manage login session information, although the db should still be encrypted at rest (some of them have features for this). If you perform all maintenance for a secret, don't even bother giving it to the user