Reputation
Next privilege 125 Rep.
Vote down
Badges
5
Newest
 Editor
Impact
0 people reached

Jan
6
comment Is this a secure data exchange scheme for a game?
Hashing the password clientside protects the password from the server. So even if someone gets to sniff traffic where TLS is added and removed it's harder to use the sniffed passwords in other places (as password reusing is quite common). Of course server-side hashing is still important.
Dec
17
comment How to replace SSL/TLS?
Some weird idea: consider an situation where PHP handles only data and everything else are static files. Could not those static files can be hosted in a HTTPS static server (GitHub Pages + CloudFlare, as an example), providing authentication and preventing any MITM possibility, and communication with the insecure PHP backend encrypted with JavaScript? The "better safe" HTTPS to HTTP XHR blocking can be circumvented with GD and <canvas>.
Oct
24
comment Is there any reason to block HTTPS?
Adding up: .../virusscan/injectvirus/...
Oct
19
comment Is there any way to safely examine the contents of a USB memory stick?
From the answers seems there are hardware and software attacks. The first type can be controlled specific USB hubs which isolate power. The second seems harder as they can hidden at firmware and ending up undetected.
Oct
12
awarded  Editor
Oct
12
revised Checking domains HSTS status
Fixed http://%20https:// URL
Oct
12
suggested approved edit on Checking domains HSTS status
Sep
17
comment If a provider sees the last 4 characters of my password, can they see it in full?
What if the last four characters are stored using a hash with high number of collisions, as it will be used for a simple one try verification? If this hash gets brute-forced it will generate many false results which will not help too much getting the full password.
Sep
12
awarded  Autobiographer
Sep
5
awarded  Commentator
Sep
5
comment Is there a way to download a PHP file without it being executed?
Is what I said. By the way maybe I don't saw any problem with this because where I live the laws related to this are too recent so even cases where people did it maliciously don't got jailed (at least as I can record).
Sep
3
comment Is there a way to download a PHP file without it being executed?
Many phishing mails link to pages hosted on hacked websites with weak passwords, so maybe is possible to get access just guessing those. Of course you don't get too much with this.
Aug
16
comment How to use phone's Wifi tethering to demonstrate security vulnerabilities on phones
If you're allowed then you can use zANTI2. It already comes with an image replacement function so it's useful if you're doing a demonstration about MITM attacks.
Aug
13
comment Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?
No one will task about SRP? It's important as it protects the password from the server without using password-equivalents and just have the problem that, without an native implementation by browsers (which seems no one wants), it can be maliciously replaced, like happens with hashing. (BTW, do you still support non-javascript users beside search bots? those bots don't login!)
Jul
27
comment Why disable JavaScript in Tor?
There are some ways from this question, but Tor disables those even with JavaScript enabled, like disabling WebRTC and detecting some bad behaviors.
Jul
18
comment Why doesn't DNS spoofing work against HTTPS sites?
One thing about this: it's common in my country to people ignore those warnings because our government CA isn't installed by default in browsers. It's security hole here, I don't know about other countries. In the other hand: use HSTS to disable the possibility to ignore the warning, better if pre-loaded.
Jun
30
comment Unsubscribe safely
Seems that title is a quite simple: I thought it was about how to implement a secure unsubscribe link when I saw it in Hot Network Questions.
Jun
11
comment How do I verify that WhatsApp is using end-to-end encryption?
@Ulkoma What if I text it to myself? (i.e. other device of mine) There's a law against that? Can I just say I was just taking a note about your comment?
Jun
11
comment Identicon for SSL certificate
Does someone already suggested to be implemented in a browser, beside the one cited? Some browser, like Chrome, could show it when users click "Advanced" on a SSL error. Maybe also show a button to permanently trust the certificate ( like Mozilla do ) when it repeats after some time. Of course it needs to be disabled when HSTS is used.
May
13
comment when is it safe to click through an SSL warning message?
I don't know why browsers don't make that last point easier: even if there is free and trusted HTTPS using proxy servers (like CloudFlare) the proxy server itself is a point of failure. Making easier to check authenticity for unknown CAs and self-signed certs is a good alternative or not? Like showing a randomart when the users show that he "understand the risks".