769 reputation
617
bio website
location Oregon
age 26
visits member for 3 years
seen Apr 24 at 23:22

I barely know anything about everything.


Jul
27
awarded  Yearling
Jul
2
awarded  Curious
Oct
10
awarded  Popular Question
Sep
2
awarded  Popular Question
Jul
27
awarded  Yearling
Feb
23
awarded  Notable Question
Nov
21
comment Why do we ask for a user's existing password when changing their password?
Requiring re-authentication provides an added defense against Cross Site Request Forgeries (CSRF) which, given the context of changing the password, would be especially devastating.
Nov
8
comment Is JavaScript self-injection dangerous?
I thought storing unescaped data was in itself a security risk (albeit a very small one), therefore you should be escaping data before it is stored in the database.
Nov
8
comment Is JavaScript self-injection dangerous?
Supposing the hacker could somehow inject the JS into someone else's profile (via hacking account, CSRF, etc.) then there is a definite risk. The JS could be used to create an entirely different page (most easily with an iframe). That new page would overwrite or overlap your existing page, and it would capture sensitive information entered by the user.
Nov
8
accepted Exposure risk of knowing only social security number?
Nov
7
comment Exposure risk of knowing only social security number?
But theoretically, if there were a SE vector, couldn't someone just start guessing arbitrary SSNs (while following the typical structure for state/age/regions) to just steal a massive amount of data?
Nov
7
asked Exposure risk of knowing only social security number?
Nov
6
comment Attacking an office printer?
If you want a step by step tutorial, defer to the movie Office Space.
Oct
11
comment How is 4G LTE encrypted?
I don't think anyone would expect their data to be secured while transmitting over standard HTTP, so I wouldn't call that a weakness of 4G.
Oct
11
comment How is 4G LTE encrypted?
@D.W. According to ETSI, that was one of their reasons for choosing SNOW over KASUMI (I cannot find the direct quote at the moment).
Oct
10
answered Will this work? Revealing identity (facebook) of person who clicks specially crafted link
Oct
10
answered How is 4G LTE encrypted?
Oct
8
comment Can an attacker slow down my server without compromising it?
@SeanW. To quote: "My first thought (was) that we've been compromised, however after checking logs, histories, databases, etc. I see no indication of that". Emphasis mine.
Oct
8
comment How to secure data before returning Macbook Air?
Notably missing from this question is whether your Macbook Air uses a HDD or SSD. This is a critical aspect of your question. (Also, @Luc: many SSDs support a full disk AES encryption, storing the private key to NVRAM. On a secure wipe, the private key is erased, a new is generated, and the remaining data is left inaccessible (unless the attacker somehow breaks AES or discovers the private key, which is unlikely).
Oct
4
accepted Calculating complex password entropy?