Reputation
33,805
Next tag badge:
99/100 score
20/20 answers
Badges
7 63 127
Impact
~1.7m people reached

2d
comment What are the privacy and security implications of Windows Telemetry
@Polynomial yeah I'd agree disabling telemtry would seem like an idea, although if it's done in an unsupported fashion (i.e. the OS doesn't recognise that as an option) there's always the risk that it'll just get re-enabled in a later update.
2d
comment What are the privacy and security implications of Windows Telemetry
Thanks for the answer. Is this information specific to the telemetry service or just general information that Windows collects? I've had problems in tying up what's telemetry (which was back-ported to win8/7) and what's general data passed back to MS.
2d
comment What are the privacy and security implications of Windows Telemetry
@AndréBorie the general reporting I've seen on this says that windows 7/8/8.1 now have telemetry enabled (e.g. forbes.com/sites/gordonkelly/2015/08/30/…) One of the problems is I don't see any information about whether I should actually be concerned about telemetry from a privacy standpoint. I'm not sure if it's anything to be concerned about or not (hence the question)
Aug
29
comment Is always using HTTPS a good idea?
the reason is that once the user has logged in, if you revert to an unencrypted connection, the session token will be sent over the Internet in a clear text format, which could allow it to be intercepted. As the session token is essentially as good as the password for the duration of the session, this is a bad idea.
Aug
22
comment Why not create your own encryption?
there's a whole field of study dedicated to analysing and defeating unknown encryption algorithms, it's called cryptanalysis en.wikipedia.org/wiki/Cryptanalysis
Aug
22
comment Why not create your own encryption?
This question already has a good set of answers here security.stackexchange.com/questions/2202/… but basically the answer is that designing encryption algorithms is hard and you are very likely to do it badly. Even experienced well funded people make mistakes with crypto
Aug
21
comment OWASP A9 - Maintain the latest security patch level for third party libraries and software
Unfortunately I don't think this question is answerable in the scope of the site. Product recommendations are off-scope (they are ontpic at thttp://softwarerecs.stackexchange.com/) and any other answer would be a generic (find what libraries you have and use a tool to check for available patches)
Aug
19
comment How to Estimate time taken for Web Application Security Testing?
good answer, I'd add another factor of "what environment is the test to be done in", its generally easier to test apps in dev/test environments as you can use automated tools more freely without the risk of impacting prod.
Aug
18
comment Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?
@dhaupin dropped in an answer as I have seen a script targeted at addressing this :)
Aug
18
comment Is it Feasible to Block Connections That Windows 10 Uses to Push/Pull? - ie: Phone Home, Watchers, Monitors, Onedrive, Cortana, Bing, Shadyness, Etc?
Fundamentally if you don't trust Microsoft to some degree here, you'd be better off not using Windows 10 or otherwise, as realistically specific IP address ranges could be changed at any time.
Aug
14
comment Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?
A bit off-topic but If you're looking for an ISP in the UK that doesn't get up to this kind of nonsense, I'd recommend Andrews and Arnold (I have no affiliation with them beyond being a satisfied customer), they're not necessarily the cheapest but good service and none of this kind of thing.
Aug
14
comment How safe is it if encrypted text is exposed?
the algorithm used would presumably be named in the source code. and presumably any password required to decrypt the key is also there?
Aug
14
comment How safe is it if encrypted text is exposed?
ok, so I'm assuming that the application has to be able to decrypt the client key? If the code to decrypt the key and the key itself are contained in the source code repository why would someone who can see the repository not be able to just read the code and then use it to decrypt the key?
Aug
14
comment How safe is it if encrypted text is exposed?
so if you have a secret in the code repo. you presumably also have the code. the code must include a method for decrypting the secret (otherwise it's unsuable). so someone with access to the code has both the secret and the means to decrypt it.
Aug
13
comment How is Facebook accessing my iPhone texts in order to recommend friends?
@ShanZhengYang do you have your phone number in your Facebook profile? If so, then I'd guess that if your contacts use the facebook app. it may be connecting you in that fashion...
Aug
13
comment How is Skype showing ads from my Google search history?
@Al-Muhandis well absent another option, I'd wager they're sharing the e-mail address. as to the legality, I'll also suggest that was in the T&Cs you signed up to with skype :) to quote the Skype privacy policy "And we use data to help make the ads we show you more relevant to you"
Aug
13
comment Why do popular sites like Google, Dropbox, etc. have a “trust this computer” checkbox when it weakens security?
without knowing more about the system in question this question isn't really answerable. What might stop it could be a variety of things (like the application asking for further auth. before trusting the browser, heuristics looking for odd patterns of access, notification to the user that they're logged in from multiple locations etc). The "silent ticking" you describe may or may not be possible, but it depends on the implementation and the attackers.
Aug
13
comment How is Skype showing ads from my Google search history?
@Al-Muhandis well if it's google ads and you use the same e-mail then the ad engine could just use that to tie your identities together, and it hasn't given your data to a 3rd party as it's all google...
Aug
13
comment Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?
@begueradj that and I know that BT have a reputation for this kind of behaviour :)
Aug
13
comment cURL and custom Rest API authentication exposure
yeah I was intending to suggest that Digest is better than basic, but that isn't really clear, I'll edit, ta.