446 reputation
27
bio website
location Redmond, WA
age
visits member for 2 years, 9 months
seen yesterday

Jul
9
comment Is it possible to prove which public key was used to encrypt a message?
I have a feeling this is going to depend somewhat on the precise protocol chosen; don't some of them basically say, "hey, I was encrypted with Bob's public key #1!"?
Jun
27
comment How to encrypt files without giving the user access?
@csharpler - for a single-player game, it probably doesn't matter (they're cheating themselves - usually). If it's an MMO, you better be storing it/trusting it from the server, period; if you don't run the game on hardware you control (completely - even consoles can be hacked), the end user can do whatever he wants, including sending false 'advancement' events to update the save-game state on a server.
Jun
20
comment Can you protect corporate email on personal phones without the option of wiping all personal data?
Is having a backup of your phone no good? Most of the data on a phone is synced to a cloud account anyways, often - pictures, contacts, emails.... something that is inherently 'backed up' by use. Granted, things like saved games may not be (...maybe, depends on platform) - what are you worried about losing?
Mar
2
awarded  Citizen Patrol
Feb
20
comment Strategies to store/remember very long password?
Note that, in your example of using text from the Bible, you're going to have problems if you're not using the same translation/source document.
Feb
13
comment Preventing online voter fraud
Related/potential duplicate(?) is this question. Although I'm somewhat biased, having the answer with the most votes.
Jan
30
comment SQLi-protection ORDER BY
+1 for the whitelisted columns, which is probably the only real option. Although, I'd probably anticipate the provided variable being an 'alias' (as a key to a hashmap with the real column name), as otherwise you're exposing implementation details to the outside world. There's a variety of ways to get the list, but that's somewhat unimportant. Perhaps the best reason to use a whitelist - generally speaking, for performance reasons, you'd want to limit ORDER BY clauses to using columns backed by an index.
Jan
3
comment How is Chase Mobile Deposit Secure?
In regards to point #1, it's possible to sign over a check written to you to someone else. If I do that, the equivalent operation is that I deposited the check, then write you a new check for the same amount - we're just making this a little simpler for us (but not the bank). This may be how some check-cashing (payday loan) operations work. In that case, it's none of the original writer's business what I'm doing with the money.
Jan
2
comment What does a HTML filter need to do, to protect against SVG attacks?
@D.W. - I'm not sure if it applies to SVG (or to what extent), but it's possible to send images (server -> browser, at least) as a solely binary representation (ie no file name/location, although I think you still had to indicate the type). This might take more work, but potentially you could create some sort of 'grammar' (like the tags used here or in phpBB forums). What are the bounds here?
Jan
2
comment GPU powered Password cracking machine - buy metal or cloud?
@F.Hauri - Looks like Amazon has had them for a while. Certainly there's no screen 'directly' attached, but as they point out in the article, there's multiple possible uses for that kind of computing architecture. It's already been used for password cracking
Dec
26
comment How can a novice find proof of a system compromise?
... If he's not already running an AV or malware scanner, attempting to add/install one would potentially compromise evidence. Besides the potentiality that a good virus may be able to root the AV (or its installer), at which point a check could return nothing.
Nov
29
comment How serious is a local virus in terms of network security
@Tom - Depending on how your AV is setup, it'll popup notifications for even (failed) drive-by-downloading attempts, which never make it past the firewall, let alone being able to install. You'd wipe the machine for something like that?
Nov
27
comment How serious is a local virus in terms of network security
Fine, twist my arm will you...
Nov
27
answered How serious is a local virus in terms of network security
Nov
27
comment How serious is a local virus in terms of network security
There's two possible states I can think of: 1) The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do; and 2) The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data would have been already exfiltrated, and there's nothing to do but check the logs...
Nov
23
comment HQL injection example
Sorry, without a salt (and even apparently with), MD5 is considered a broken hash. Just have a look around (for example, this question)
Nov
21
comment Should I give developers admin rights or leave as power users?
What languages are you working with? Don't some debuggers (say, for C/C++) require elevated privileges?
Nov
21
comment HQL injection example
Are you sure the passwords are hashed? The naming of stuff up there makes it seem otherwise... And at minimum, you don't appear to be using salts.
Nov
13
comment consequences of grey hat hacking
Please note that, given the TOS of most websites (and some government laws), hacking even your own account is (potentially) illegal, even if it results in no gain (material or otherwise) for you. And they only have your word that you only hacked your dummy accounts, too...
Nov
9
comment Why are triggers not often used to secure a database?
Especially since, with anything short of parameterized query, if you miss something in either validation list (black/white), triggers might not save you anyways; they generally only get the results of the operation against a table, which wouldn't help if the DB allows multiple statements per connection. Oh, and some systems don't automatically turn them back on after a restore, either, so they might not even be on...