476 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 4 months
seen yesterday

Nov
4
comment OpenVPN detection
@greasemonkey - That question was asked a week ago. Why are you asking? One major factor in using VPNs is to disguise the origin location, both from the ultimate destination and anybody else snooping on the line - if you could detect the true location it would defeat the purpose. Further, just knowing that something is running a VPN service isn't necessarily enough to tell you that a given connection is using the service, vs coming from the computer running the VPN itself.
Oct
31
comment Can anyone be hacked?
If they just want some information from you, attacks can be as little as $5. As usual, the weakest element of the security chain isn't the technology, it's the humans around it.
Oct
31
comment What stops a developer from accessing credit card details and other secret data from a company
@AyeshK - Depending on the amounts involved, and how much it would cost to implement/for compliance/in the case of breaches, you may have better luck using one of the existing payment processors (like PayPal or Amazon's). They manage all this stuff for you, for a fee. Dealing with stuff of this nature is non-trivial, and people are becoming more wary (given the number of breaches occurring).
Oct
29
comment How can I detect a VPN connection (even just in some cases) to get the real location of the user
People concerned about their privacy (for whatever reason) are going to be annoyed at you. Comparing local/server time isn't going to work - so long as NTP is on you'd have roughly the same UTC time, but "local time" (displayed) can be whatever you want it to. What happens if I sign up on vacation in your target timezone? What about when I go back home? What happens if I sign up while flying on an airplane (no DNS entry for middle-of-the-ocean...)?
Oct
26
comment All users can write only one can read system
Again, if you're going to all the trouble of maintaining all this for somebody else (most people don't know how to deal with encryption keys), just make it so that they have read permissions in your application. You don't really need to encrypt anything at that point (even if you should for the data at rest), because the unauthorized people literally have no (legitimate) way to get the data. It's actually better than handing them encrypted records, too. If they have a illegitimate way to get the data, I'd expect they'd have a way to get non-encrypted records anyways...
Oct
26
comment All users can write only one can read system
...If you're just inserting this in a db, why not just design your API (or your website) so that sellers just don't get to see what they inserted? Note that you have to do something akin to this anyways, just to keep them from reading what they just did... You can encrypt the db if you need to (most major ones have built-in facilities for this). I have to ask, though, what kind of data are you inserting, that sellers shouldn't be able to read it? If Credit Card numbers, you probably want a system that logs reads of the sensitive info (likely do anyways).
Oct
24
comment Why require new users to change password?
@sebastiannielsen - I don't know much about those setups, but presumably actions undertaken that way are at least logged. Heck, even base desktop support may have remote control facilities, who are probably trusted far less than any admins (at minimum, every person you add increases the risk of one of them doing something undesirable).
Oct
24
comment 1'or'1'='1 help
Given that 'anything (' would (assuming it escaped the variable replacement) cause a syntax error, you need to add more Boolean checks. Personally, I'd probably swap out the ` or '1' = '1'` check for something that uses the desired username...
Oct
17
comment How can one verify that two separate emails are not coming from the same place?
Even if they do come from the same person, why does it matter? Granted, buying something from two different accounts is unusual, but not unreasonable - what about a business versus personal purchase, from two differently purposed accounts? Or for two different lines of business or something? What is it you plan on doing if it is the same person? Your customer may have a right to complain if you deny him just because he's using two different accounts...
Oct
12
comment Privacy of Image search with https
If nothing else, the mitigation steps required to make your requests private are going to look really suspicious. They may even violate one or more employee agreements you may have signed. And if you spend too much time looking at whatever those images are, you can still be called to account for wasting time at work. If there's an information breach from an insider, and they can't find any other obvious routes out, you're going to look really good for it...
Sep
20
comment Password stolen on public wifi even though https was used
Could be that he was executing a MiTM attack, and either the device didn't fully validate the certificate, or the user ignored the warnings it generated...
Sep
9
comment Is it possible to find CryptoKey from orginal password and hashed password?
Well, you could manually try brute forcing the key (and, if the op had a list of "remembered possible" passwords, that's what they would be), but it'd take a while....
Sep
7
comment Storing a user's password in a retrievable manner
Personally, I think I'd probably set up a separate server (physical or virtual instance, whatever), then have a service that takes input and encrypts/decrypts it (internal only, obviously). That is, don't put the public/private keys with the rest of your data. This would probably remove the need to encrypt with a per-user key or manage login session information, although the db should still be encrypted at rest (some of them have features for this). If you perform all maintenance for a secret, don't even bother giving it to the user
Aug
29
comment SQL injection filter evasion
@symcbean - what do you mean about dealing with text? IF it's a variable in SQL, that should still be part of a parameterized query. If you're doing something with dynamic SQL (ignoring cases where the user is allowed to write the entire query), you're better off having an explicit whitelist of things allowed - there are ways to dodge application-layer validation of things that the db will be taken in by. Or that get thrown out incorrectly - like, what about somebody searching for a book named `"A History of Unions" or something?
Aug
28
comment SQL injection filter evasion
... it would depend on things like encoding - historically some attacks have gotten through because they used Unicode encoding that the db helpfully parsed/realized, but that the application didn't bother with. Which is why the recommendation is to use parameterized queries - it doesn't care what the encoding is, it just stores it as a string). Of course, then you have to remove anything like HTML (that's a different attack)...
Aug
28
comment SQL injection filter evasion
Presumably id is an integer, so you could probably just cast it. In general, blacklists are doomed to failure, because you can't exhaust all possible inputs - the usual SQL Injection route is to actually add conditions (like = 0 OR 1=1), which would slip right through here. Really, though, you should be using parameterized queries, which should stop it cold.
Aug
18
comment Tracking IP address to prevent abuse without logging user metadata
There are publicly available libraries for mitigating abuse. Note that IP addresses are largely designed to be public, but only really have correlation to the physical world if you know the layout of the network. Which ISPs are (understandably) rather loathe to share. This isn't helped by the fact that a lot of consumer IPs are dynamic, and thus change, or may be hidden behind some form of NAT. And DOS attacks may lie about their origin IP address. What exactly are you trying to protect your users from?
Aug
17
comment How do you find out if a phone is secretly sending private data to a remote server?
Assuming this implemented in hardware/firmware, you need external network tools. For PCs this is usually at the router. With mobile phones, you may not have the requisite access to such a network - there's no way your telecom operator would let you put logging on their mobile network. Obviously this limits the data that can be sent, but certain hi-value pieces of information (like passwords) tend to be very small.
Aug
17
comment Why doesn't the OS give every application a secret password?
Asking for the password every time it's run can actually be a distinct concern from not wanting to store the password. Take a page out of web-session management; after verifying the password, you should give the app a sign-on token. Asking for a password every time is then just a means of expiring a session. If you have malware on your machine, they often try to get included in the boot process, because then they're enabled from the start (and have much better access, too)...
Aug
16
comment Attacker able to install screen capturing software in Windows 7 guest account
Your first problem is "malware I installed"... if he's already compromised your system, he can (probably) exfiltrate the decrypted keepass file. Which would be a wonderful, hivalue, easy-to-find target. Keyloggers and stuff that sniffs the clipboard (where copy/paste data is stored) are standard, so screen capture isn't even strictly necessary.