446 reputation
27
bio website
location Redmond, WA
age
visits member for 2 years, 9 months
seen 11 hours ago

Apr
22
comment Web Application Authentication Using Computer Properties
Then why not just give them a cookie?
Apr
20
comment Storing private messages in a database
er, what? How does that change anything? Beyond being a potentially problematic requirement from a client, I mean. So far, nothing you've described about your system would warrant that kind of effort. At most, if it was required to store the messages encrypted per-user, I'd just assign everybody public/private keys, then encrypt per-destination-user. But you'd have to store the keys securely anyhow, which would best be accomplished by encrypting them with an application key, at which point why not just encrypt the db with the application key...
Apr
20
comment Web Application Authentication Using Computer Properties
Heck, the user may not even be in any control over some of this - ie, a Windows update will change the OS version, the browser version, fonts may be removed (or renamed) for licensing reasons, ip addresses are usually dynamically assigned by the ISP.... MAC addresses are known to have duplicates, too. And of course, the client can just flat-out lie about any of this anyways.
Apr
19
comment Storing private messages in a database
If you're handling all the encryption, you don't even need a key-per-user, you can just encrypt it with a single key. Since otherwise you'd have to control access to the decryption keys, you can simply control access to the message - encrypting the database would be just to prevent disclosure if the db gets stolen.
Apr
19
comment How to trace an active cell phone call?
Note that if you're not part of law enforcement, you essentially can't do this without some existing software installed on the phone, and probably a GPS too (ie, you have to enable a "report location" feature). The information required to track by signal strength isn't available to the public, for any number of reasons.
Apr
19
comment How can I allow only authorized browsers to access a website?
Note that HTTP headers are trivial to forge, and in fact some browsers provide tools or plugins to help you do this (ie, User-Agent won't tell the truth).
Apr
19
comment Hidding ip address in a peer to peer connection
... how is this different than just one server? If both clients are trusting a third party (their proxy servers), why does it have to be two of them? A single server would be vastly simpler to deal with.
Apr
19
comment Is a properly configured server secure against unauthorized data access?
#ahem# - you've missed my point; if the resource being paid for is something that's simply distributed (say, a special image), only one person needs to pay for it. This is essentially the problem movie/music producers have run into. Once one person has it, they can give it to others. MMOs and social games aren't distributing anything - their server code and interaction with other users. That fancy hat in TF2? Sure, the art is present on your machine, but it's the server which says which player has it, so nobody else gets to see you with it.
Apr
18
comment Is a properly configured server secure against unauthorized data access?
There's news in several blogs, and the top google results are actually for the server torrent. I thought I saw something about the game needing to download additional data, but given the size of the installs this is likely incorrect. The net effect in your case is identical, though; essentially the application is asking for some data (in AC2's case, essentially a simple Boolean), so a local server is written to host it. Besides the original pirate, nobody talks to your server.
Apr
18
comment Confused about the most relevant way to secure my APIs
Umm, the way most browsers deal with HTTPS/SSL is specifically designed to prevent MitM attacks. XSS and CSRF attack are unrelated to HTTPS/SSL (HTTPS/SSL simply encrypts the line, those attacks just give you something new to say). Unless you have tech-savvy users with out-of-band knowledge, you need a secure way to distribute (a bootstrappable portion of) your app - in current browsers, that's HTTPS/SSL. There's no way to prevent a client from mucking with his own key - although that may be rather pointless. All of that is to prevent the key leaking to other people.
Apr
18
comment Cracking encrypted SQB databases
Except, assuming the vendor has implemented the encryption securely and properly, they don't have any better chance than the OP. Given that most business want to protect themselves from rogue employees, this is a huge security concern.
Apr
18
comment Confused about the most relevant way to secure my APIs
#scratches head# still confused there. What specific threats will HTTPS not solve for you? If you want a secure way to distribute your app from your website alone, you need HTTPS (for one or more portions of your site). Neither of the articles seems to argue that HTTPS is in any way insufficient. The HMAC article is essentially doing a related version of the protocol. You'd need to provide more details for me to get where you're headed with this.
Apr
18
comment Is a properly configured server secure against unauthorized data access?
I have a simple way to get access to duck.png - I grab it from a site which logs all resources encountered (Essentially, just a regular pirate site). Ubisoft tried something similar to "only send when needed" with some of it's games - it just delayed things a little until hackers figured out how to create a dummy server. If you distribute a resource, it will be passed on to unanticipated 3rd parties. Therefore, the only ~permanent way to avoid this is to not distribute it... hence server-based games (MMOs, social gaming, cloud game servers...)
Apr
18
comment Confused about the most relevant way to secure my APIs
There's no way to ensure that only the JavaScript you wrote is hitting your backend. In fact, I'm going to guarantee that once the public gets access to the code, there'll be a hacked version. Note that even without source code being distributed game publishers have been failing at this for years, and JS distributes the source code... I'm not sure why you think HTTPS is "not enough" - Note that you'll need to distribute your JS application under HTTPS to ensure your client can trust it... Afterwards is a different story, but you'd need a similar style of encryption anyways, so...
Apr
18
comment Is there any mail service accepting real id?
Accepting an id how? During signup? Remember that most web-portals are designed with quick turnaround times in mind, and adding anything to do with a real id would increase that. Among many, many other problems. During login? Some businesses use smart-cards, which contain additional authentication factors (private key, probably). Since these can be lost too, they usually just have a password (potentially unique). What's your expected use-case here? Can you give us more details?
Apr
18
comment What needs to happen for email encryption to go mainstream?
@Jason - Well, only if they ask for something that ties it to a real-world identity (that states where they are), otherwise people can use things like Tor, or just a vanilla VPN connection... On the internet, it's trivial to lie.
Apr
15
comment Steganography for BMP
Probably too broad, but steganography is usually accomplished by adjusting the low-order bit(s) in each byte. Depending on the data/operation used, this leaves patterns (sometimes visible in the image). It sounds like OpenPuff is assuming the data is encrypted before hiding (because good encryption results in near-random data, this makes discovering something was hidden much more difficult/impossible) - you need a tool that doesn't care about encryption. Did the prof tell you what the encoding was? I'd assume it results in ASCII text for a first go.
Apr
13
comment Heartbleed: hackers have already used the vulnerability?
...you seem to be missing a link to source of this report.
Apr
13
comment Alternative to ICANN?
So, you and I walk up to a third person, each of us with another guy with us and say, "This guy here is Jeff Bezos". And they're both bald, and promise drone delivery, etc. How does guy number 3 know which "Jeff" is the real one - or even if either is the "Amazon.com Jeff"? Why should person 3 listen to either of us? If 3 gives one of the Jeffs $10 and doesn't receive a book, what name/address does he give the police? How can 3 be confident that a new Jeff is the "correct" one?
Apr
11
comment How vulnerable is Windows 7 to brute force attacks?
...among other things, there's a delay so that you can't check "how many characters are correct" (ie, no early exits for performance). If you have physical access to the machine, I'd pull the drive and access the data with a separate OS installation (or just start from a Live CD or something). For a six character password, finding a colliding hash may be faster (although I don't know how Win7 stores password data in terms of salts, etc).