Reputation
Next tag badge:
145/100 score
17/20 answers
Badges
8 72 144
Newest
 Good Answer
Impact
~2.3m people reached

1d
comment Advantages to killing sessions after 5 minutes?
This is of course a good idea where you control all the client machines and can enforce policy on them, although again I've seen environments where people insist on applying that at the application layer and the OS layer regardless...
Apr
17
comment How can mom monitor my internet history from a distance?
Without software installed on your machine (or someone manually installing a certificate on your machine), there's no way to intercept HTTPS connections (unless of course your ISP can break HTTPS, which is doubtful). Kaspersky would likely not tell you about it if it's "legitimate parental control" software, as that's not strictly malware.
Apr
17
comment How can mom monitor my internet history from a distance?
heh, ISPs in some countries can and do monitor/block connections legally, it's in the T&Cs, no warrant required.
Apr
17
comment How can mom monitor my internet history from a distance?
Not sure about the "not your ISP" piece. Some ISPs sell add-on "parental safety" software which is monitoring stuff by any other name
Apr
17
comment How can mom monitor my internet history from a distance?
OP said he didn't use the university network so not likely them...
Apr
5
comment Software Library Vulnerability Tracking
This question likely won't go anywere as it's a bit of a product recommendation (which the mods in their wisdom have decided is off-topic) with that said you could also look at source clear (srcclr.com) as I believe their product covers this kind of area
Apr
2
comment Can MITM redirect my HttpsURLConnection?
if the attacker has a Certificate Authority installed on the device then they can create certificates on the device with any name they like, which the device will trust. The key to pinning is that you're not pinning the name, you're pinning a specific certificate. The attacker isn't able to recreate that, therefore can't bypass the pinning. This doc. owasp.org/index.php/Certificate_and_Public_Key_Pinning#Android from OWASP may help to explain the concept.
Apr
1
comment What range of IP addresses is represented by the CIDR block 172.16.0.0/12?
this sounds more like a question for networkengineering.stackexchange.com
Mar
31
comment Keylogger web application protection
@halfinformed I'd agree 2FA can be a very useful control, it all depends on the threat model that's of concern, in this case it's just important to note that it has limitations given the likely way that keyloggers get onto machines (i.e. as part of malware which is likely to have elevated privs to the system and other capabilities)
Mar
31
comment A secret in a URL
@アレックス that would likely depend on the server in question. In many cases they would store full URLs and I would regard that as a downside of placing tokens in URLs , although it's likely (depending on the threat model) less of a concern as the attacker would need access to the server.
Mar
30
comment A secret in a URL
it's worth noting that with HTTPS the hostname (api.somewebsite.com) is passed in the clear but the full URL is not, so it will not be susceptible to casual traffic sniffing attacks in that case.
Mar
27
comment how to properly establish a connection to a remote host without router?
I'd suggest that the reason that what you're doing isn't working is that you need to forward the port from your Internet facing IP address to your mobile phone. the IP address in your question for the mobile phone is a non Internet routable one (192.168.42.50) so if you want a host on the Internet to be able to connect to the port on your system you need to get port forwarding working. Depending on the level of control you have over your network, this may or may not be possible.
Mar
17
comment Is there a cipher suite “translator”
may not be exactly what you're looking for but testssl.sh does a nice table at the end of a scan which is more readable than the standard Cipher lists
Mar
16
comment Are Ubuntu updates signed by a central authority?
Even with distrbuted signing, unless you have parallel development/code review you risk malicious code being signed due to the author being "malicious" or compromised.
Mar
15
comment How to widely advertise a fixed important threat in widely used open source software?
well looks like it made the front page of Hacker News tonight anyway... news.ycombinator.com/item?id=11292488
Mar
14
comment How to widely advertise a fixed important threat in widely used open source software?
@user2284570 you have a blog link?
Mar
7
comment School website exposes root FS, where to report?
I'd be very careful before taking this advice, there have been occasions where this kind of contact has been mis-interpreted and the reporter accused of hacking. I'd recommend reporting anonymously.
Mar
1
comment Security risk of a service that allows a user to test from connectivity from a server to a printer
sorry I mis-interpreted, feel free to edit again :) I'd definitely say that having a pre-defined list of printers and not letting users put in free form data is the way to go.
Feb
27
comment strategy for dealing with glibc issues through all docker containers
@DeerHunter no, there's nothing implicit in using docker to this problem, it's relying on a software stack you can' update, you get the same problem with many "appliances" where you have no control over the OS-level software
Feb
13
comment Some specific website not loading when proxy through Burp
You could try settings your browser to use the SOCKS proxy without burp to see if there are any helpful errors generated, which might give you some more info. Also if you put a note of the SSH command your using to do the SOCKS proxying (I'm assuming here that's what you're doing..) that could be useful