476 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 2 months
seen 8 hours ago

Sep
9
comment Is it possible to find CryptoKey from orginal password and hashed password?
Well, you could manually try brute forcing the key (and, if the op had a list of "remembered possible" passwords, that's what they would be), but it'd take a while....
Sep
7
comment Storing a user's password in a retrievable manner
Personally, I think I'd probably set up a separate server (physical or virtual instance, whatever), then have a service that takes input and encrypts/decrypts it (internal only, obviously). That is, don't put the public/private keys with the rest of your data. This would probably remove the need to encrypt with a per-user key or manage login session information, although the db should still be encrypted at rest (some of them have features for this). If you perform all maintenance for a secret, don't even bother giving it to the user
Aug
29
comment SQL injection filter evasion
@symcbean - what do you mean about dealing with text? IF it's a variable in SQL, that should still be part of a parameterized query. If you're doing something with dynamic SQL (ignoring cases where the user is allowed to write the entire query), you're better off having an explicit whitelist of things allowed - there are ways to dodge application-layer validation of things that the db will be taken in by. Or that get thrown out incorrectly - like, what about somebody searching for a book named `"A History of Unions" or something?
Aug
28
comment SQL injection filter evasion
... it would depend on things like encoding - historically some attacks have gotten through because they used Unicode encoding that the db helpfully parsed/realized, but that the application didn't bother with. Which is why the recommendation is to use parameterized queries - it doesn't care what the encoding is, it just stores it as a string). Of course, then you have to remove anything like HTML (that's a different attack)...
Aug
28
comment SQL injection filter evasion
Presumably id is an integer, so you could probably just cast it. In general, blacklists are doomed to failure, because you can't exhaust all possible inputs - the usual SQL Injection route is to actually add conditions (like = 0 OR 1=1), which would slip right through here. Really, though, you should be using parameterized queries, which should stop it cold.
Aug
18
comment Tracking IP address to prevent abuse without logging user metadata
There are publicly available libraries for mitigating abuse. Note that IP addresses are largely designed to be public, but only really have correlation to the physical world if you know the layout of the network. Which ISPs are (understandably) rather loathe to share. This isn't helped by the fact that a lot of consumer IPs are dynamic, and thus change, or may be hidden behind some form of NAT. And DOS attacks may lie about their origin IP address. What exactly are you trying to protect your users from?
Aug
17
comment How do you find out if a phone is secretly sending private data to a remote server?
Assuming this implemented in hardware/firmware, you need external network tools. For PCs this is usually at the router. With mobile phones, you may not have the requisite access to such a network - there's no way your telecom operator would let you put logging on their mobile network. Obviously this limits the data that can be sent, but certain hi-value pieces of information (like passwords) tend to be very small.
Aug
17
comment Why doesn't the OS give every application a secret password?
Asking for the password every time it's run can actually be a distinct concern from not wanting to store the password. Take a page out of web-session management; after verifying the password, you should give the app a sign-on token. Asking for a password every time is then just a means of expiring a session. If you have malware on your machine, they often try to get included in the boot process, because then they're enabled from the start (and have much better access, too)...
Aug
16
comment Attacker able to install Screencapturing Software in Windows 7 Guest Account
Your first problem is "malware I installed"... if he's already compromised your system, he can (probably) exfiltrate the decrypted keepass file. Which would be a wonderful, hivalue, easy-to-find target. Keyloggers and stuff that sniffs the clipboard (where copy/paste data is stored) are standard, so screen capture isn't even strictly necessary.
Aug
15
comment Is it possible for a phone to be transmitting even while turned off and the battery removed?
Putting a phone in a freezer is a terrible idea, for two reasons - 1) If there's excess humidity, the device may receive water/liquid damage (or the condensation accumulated upon removing it) and 2) excessively cold temperatures damage electronics and batteries - my phone complained about the winter where I currently live. Buy a surplus ammo container instead. I find it implausible that a simple timekeeping battery would have the power to transmit anything, much less usual distances. Turn the microphone on, maybe. Some people also buy additional batteries, which would give false positives.
Jul
26
comment Database compromised and some passwords cracked
...When you're running a web server, you're supposed to turn off verbose error messages (displayed to users) in the first place. This sounds like you put this setting in the other direction, frankly. And you need to make sure people don't just reuse their old password, too, or safely resetting it is going to be pointless.
Jul
26
comment Track my girlfriend's stolen computer
@RSFalcon7 - Maybe you can't get this information, but I'm wondering if Google/Facebook will log attempts with a recently expired password? You're going to have to turn this information over to the police anyways...
Jul
17
comment Restricting source code to domain name
What happens if they change their domain name? Due to trademark disputes, business merge, whatever. Note that most system admins hate automated updates to production systems, because it can cause things to break unexpectedly. What do you mean by "source code" - if you distribute the source it makes removing protections much easier. If you're not really worried about piracy, why use DRM?
Jul
13
comment How long does it take for Google to detect click fraud and suspend an AdSense account?
If I remember right, serving an ad is an impression, and getting somebody to buy something afterwards (or whatever it is that you're "selling") is called a conversion. Any marketing manager wants the ratio to be 1. If a source of impressions isn't getting you any conversions, you drop it (because it's bringing your numbers down, and costs you money). If an ad network doesn't have tools to find this sort of behavior (at minimum with an anonymized id), it's inadequate.
Jul
6
comment Where to save digital content and prevent sharing?
This is DRM. All major companies have found, despite millions or billions of dollars spent, that you can't stop this, long term. The moment you give somebody a file, they're able to give it to somebody else (they don't even need to redownload it). You can delay it somewhat by using nonstandard file types and a custom reader, but it won't stop people, and will just annoy everybody else. In fact, historically, that's mostly what DRM has done - annoy the legitimate users. Ubisoft failed so bad people were running pirated versions because the copy they bought was giving them grief.
Jul
6
comment How to defend against auto-scanning license plate cameras? (computer vision)
You might get in trouble if it prevents law-enforcement readers from operating. You might check if your local jurisdiction has rules against obscuring plates. If the system alerts cops that you're doing something like this, they might pull you over to find out why. This would have to be on 24/7 to prevent reads while parked, watch out for draining the batteries. If your car gets stolen, this will work against you.
Jul
5
comment Is this a bot fishing for security vulnerabilities on my site?
@birdieblue - Perhaps you've been targeted by a bot randomly crawling the web? It's not necessarily something that you can determine without a lot of research.
Jun
29
comment Is it possible to implement a secure game without having a reliable arbiter?
This, as in so many other problems, isn't really a technical problem, it's a people problem. The only thing different about the computer is they have a terrible time with random numbers. You'd face the exact same problem in a regular board-game version of chess. Why do you think major tournaments have judges for games? Consider the computer an extension of the player, solely a vector for playing the game, and you'll be thinking in the right direction; that is, what happens if you play a normal board game over Skype or similar?
Jun
20
comment Is providing a website password over the phone any less secure than other identifying information?
As opposed to the information you are giving them, which is potentially sufficient for identity theft? The touchtone password is probably safe from the CSR, at least.
Jun
20
comment Is providing a website password over the phone any less secure than other identifying information?
@Schroeder - who decides the "random" letters? What happens when dealing with something like Arabic, where some letters combine in words (so computer output might not be correct, or otherwise match what a person gives)? If the CSR doesn't ask you the question, it's essentially a call-in pin (of only two digits). If they do, it's likely to be publicly available information. Too, some people are going to have a hard time figuring out character index, and so will write it down... potentially permanently. I dislike that scheme.