466 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 1 month
seen 17 hours ago

May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
Yes, but that's the only thing you can do. If I can send a negative timestamp, I can send a (near) 0 duration one. Also, fun stuff - the user may not have control over the system clock, so it may get rolled backwards unintentionally (due to NTP). Now what?
May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
There's no way to secure this from a determined cheater - as you've noted, they can perform their own encryption. Heck, at that point they could supply their own timestamps; witness all the "high scores" for Angry Birds (or other games) in the iOS leaderboards. This also applies to estimating latency - you'd need a round trip to do this, which means waiting for the client to respond (see the problem there?). In short, nothing you can do will prevent people from submitting false information, the only thing to trust is your server. Duration is sending question to receiving answer.
May
2
comment How can I validate time-sensitive data is coming from a mobile app, and not being forged?
Er, there's one simpler way I have to defeat this: While answering the question, set the system clock backwards in time. Negative duration! Beyond that, you're still performing the encryption on the client, which is still outside of your control - the user can still access that to pass whatever timestamps they want. The harder you protect it, the more it tempts a certain crowd.
Apr
29
comment Securing remotely accessible IP cameras that do not support HTTPS
Sorry, it wasn't immediately clear to me that the cameras were able to attach using the secured network. Say, that most of your home network uses WPA2, but the cameras weren't really using it.... yeah, that's not too likely is it...
Apr
28
comment Securing remotely accessible IP cameras that do not support HTTPS
Are these wireless or wired cameras? If wireless, do the cameras support a wireless security protocol? Securing the data to the router doesn't do much good if you then broadcast it in the clear to the camera.
Apr
28
comment Can I determine a private key given the encrypted data and corresponding cleartext?
Thankfully, this is the case, or public/private key cryptography would be broken. In such a case, anyone sending a message could read all other messages. In the case of the one-time-pad, only a few people are given the key in the first place, so it's not an issue.
Apr
25
comment Could a network host and process programs while securing against piracy?
If you're distributing code in a network, you also have to worry about a malicious user changing output from a legitimate program. Or even from just general failures (ie, fandango on core, wonky calculations from overheating, etc). Which case is which would be impossible to prove without forensic-level examination. Essentially, you're asking for a decentralized version of Google's AppEngine or AWS, without any of the protections a trusted system would provide.
Apr
25
comment Could a network host and process programs while securing against piracy?
Eliminating loops entirely is a non-option; they're just too useful for many things. If the language chosen allows recursion, you can run into similar problems. It's impossible to prove (in the general sense) that a given program will complete - this is known as the Halting problem. Time bombs have also historically simply given bad data, which is impossible to automatically prevent. The only way to prevent reproduction of code is to not give it to somebody - game publishers haven't succeeded in their version of this problem....
Apr
22
comment Web Application Authentication Using Computer Properties
Then why not just give them a cookie?
Apr
20
comment Storing private messages in a database
er, what? How does that change anything? Beyond being a potentially problematic requirement from a client, I mean. So far, nothing you've described about your system would warrant that kind of effort. At most, if it was required to store the messages encrypted per-user, I'd just assign everybody public/private keys, then encrypt per-destination-user. But you'd have to store the keys securely anyhow, which would best be accomplished by encrypting them with an application key, at which point why not just encrypt the db with the application key...
Apr
20
comment Web Application Authentication Using Computer Properties
Heck, the user may not even be in any control over some of this - ie, a Windows update will change the OS version, the browser version, fonts may be removed (or renamed) for licensing reasons, ip addresses are usually dynamically assigned by the ISP.... MAC addresses are known to have duplicates, too. And of course, the client can just flat-out lie about any of this anyways.
Apr
19
comment Storing private messages in a database
If you're handling all the encryption, you don't even need a key-per-user, you can just encrypt it with a single key. Since otherwise you'd have to control access to the decryption keys, you can simply control access to the message - encrypting the database would be just to prevent disclosure if the db gets stolen.
Apr
19
comment How can I allow only authorized browsers to access a website?
Note that HTTP headers are trivial to forge, and in fact some browsers provide tools or plugins to help you do this (ie, User-Agent won't tell the truth).
Apr
19
comment Hidding ip address in a peer to peer connection
... how is this different than just one server? If both clients are trusting a third party (their proxy servers), why does it have to be two of them? A single server would be vastly simpler to deal with.
Apr
19
comment Is a properly configured server secure against unauthorized data access?
#ahem# - you've missed my point; if the resource being paid for is something that's simply distributed (say, a special image), only one person needs to pay for it. This is essentially the problem movie/music producers have run into. Once one person has it, they can give it to others. MMOs and social games aren't distributing anything - their server code and interaction with other users. That fancy hat in TF2? Sure, the art is present on your machine, but it's the server which says which player has it, so nobody else gets to see you with it.
Apr
18
comment Is a properly configured server secure against unauthorized data access?
There's news in several blogs, and the top google results are actually for the server torrent. I thought I saw something about the game needing to download additional data, but given the size of the installs this is likely incorrect. The net effect in your case is identical, though; essentially the application is asking for some data (in AC2's case, essentially a simple Boolean), so a local server is written to host it. Besides the original pirate, nobody talks to your server.
Apr
18
comment Confused about the most relevant way to secure my APIs
Umm, the way most browsers deal with HTTPS/SSL is specifically designed to prevent MitM attacks. XSS and CSRF attack are unrelated to HTTPS/SSL (HTTPS/SSL simply encrypts the line, those attacks just give you something new to say). Unless you have tech-savvy users with out-of-band knowledge, you need a secure way to distribute (a bootstrappable portion of) your app - in current browsers, that's HTTPS/SSL. There's no way to prevent a client from mucking with his own key - although that may be rather pointless. All of that is to prevent the key leaking to other people.
Apr
18
comment Cracking encrypted SQB databases
Except, assuming the vendor has implemented the encryption securely and properly, they don't have any better chance than the OP. Given that most business want to protect themselves from rogue employees, this is a huge security concern.
Apr
18
comment Confused about the most relevant way to secure my APIs
#scratches head# still confused there. What specific threats will HTTPS not solve for you? If you want a secure way to distribute your app from your website alone, you need HTTPS (for one or more portions of your site). Neither of the articles seems to argue that HTTPS is in any way insufficient. The HMAC article is essentially doing a related version of the protocol. You'd need to provide more details for me to get where you're headed with this.
Apr
18
comment Is a properly configured server secure against unauthorized data access?
I have a simple way to get access to duck.png - I grab it from a site which logs all resources encountered (Essentially, just a regular pirate site). Ubisoft tried something similar to "only send when needed" with some of it's games - it just delayed things a little until hackers figured out how to create a dummy server. If you distribute a resource, it will be passed on to unanticipated 3rd parties. Therefore, the only ~permanent way to avoid this is to not distribute it... hence server-based games (MMOs, social gaming, cloud game servers...)