Reputation
Next privilege 125 Rep.
Vote down
Badges
5
Newest
 Editor
Impact
0 people reached

Apr
19
comment HTTPS web service switched to HTTP. What can go wrong?
MEGA "hash verification" is pointless: it load everything via HTTPS, as loading HTTP resources from HTTPS is blocked or, at least, raise warnings. Just desktop clients and extensions do HTTP requests, and just to download the encrypted files, as those don't need to download JavaScript files.
Apr
14
comment How does storing hash passwords work?
For web applications the proposed solutions below apply well. Also JavaScript can't be trusted because it can be replaced when the server gets attacked. The question don't say "web applications": why Secure Remote Password isn't used ( and isn't the standard ) for applications where code security and performance are not problems?
Mar
14
comment Is HTTPS secure over public Wi-Fi with an expired certificate?
How about HSTS?
Mar
12
comment How to find out what programming language a website is built in?
How about humans.txt?
Jan
6
comment Is this a secure data exchange scheme for a game?
Hashing the password clientside protects the password from the server. So even if someone gets to sniff traffic where TLS is added and removed it's harder to use the sniffed passwords in other places (as password reusing is quite common). Of course server-side hashing is still important.
Dec
17
comment How to replace SSL/TLS?
Some weird idea: consider an situation where PHP handles only data and everything else are static files. Could not those static files can be hosted in a HTTPS static server (GitHub Pages + CloudFlare, as an example), providing authentication and preventing any MITM possibility, and communication with the insecure PHP backend encrypted with JavaScript? The "better safe" HTTPS to HTTP XHR blocking can be circumvented with GD and <canvas>.
Oct
24
comment Is there any reason to block HTTPS?
Adding up: .../virusscan/injectvirus/...
Oct
19
comment Is there any way to safely examine the contents of a USB memory stick?
From the answers seems there are hardware and software attacks. The first type can be controlled specific USB hubs which isolate power. The second seems harder as they can hidden at firmware and ending up undetected.
Oct
12
awarded  Editor
Oct
12
revised Checking domains HSTS status
Fixed http://%20https:// URL
Oct
12
suggested approved edit on Checking domains HSTS status
Sep
17
comment If a provider sees the last 4 characters of my password, can they see it in full?
What if the last four characters are stored using a hash with high number of collisions, as it will be used for a simple one try verification? If this hash gets brute-forced it will generate many false results which will not help too much getting the full password.
Sep
12
awarded  Autobiographer
Sep
5
awarded  Commentator
Sep
5
comment Is there a way to download a PHP file without it being executed?
Is what I said. By the way maybe I don't saw any problem with this because where I live the laws related to this are too recent so even cases where people did it maliciously don't got jailed (at least as I can record).
Sep
3
comment Is there a way to download a PHP file without it being executed?
Many phishing mails link to pages hosted on hacked websites with weak passwords, so maybe is possible to get access just guessing those. Of course you don't get too much with this.
Aug
16
comment How to use phone's Wifi tethering to demonstrate security vulnerabilities on phones
If you're allowed then you can use zANTI2. It already comes with an image replacement function so it's useful if you're doing a demonstration about MITM attacks.
Aug
13
comment Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?
No one will task about SRP? It's important as it protects the password from the server without using password-equivalents and just have the problem that, without an native implementation by browsers (which seems no one wants), it can be maliciously replaced, like happens with hashing. (BTW, do you still support non-javascript users beside search bots? those bots don't login!)
Jul
27
comment Why disable JavaScript in Tor?
There are some ways from this question, but Tor disables those even with JavaScript enabled, like disabling WebRTC and detecting some bad behaviors.
Jul
18
comment Why doesn't DNS spoofing work against HTTPS sites?
One thing about this: it's common in my country to people ignore those warnings because our government CA isn't installed by default in browsers. It's security hole here, I don't know about other countries. In the other hand: use HSTS to disable the possibility to ignore the warning, better if pre-loaded.