101 reputation
bio website qgustavor.tk
location Goiânia
age 21
visits member for 1 year, 6 months
seen 10 hours ago

comment How to use phone's Wifi tethering to demonstrate security vulnerabilities on phones
If you're allowed then you can use zANTI2. It already comes with an image replacement function so it's useful if you're doing a demonstration about MITM attacks.
comment Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?
No one will task about SRP? It's important as it protects the password from the server without using password-equivalents and just have the problem that, without an native implementation by browsers (which seems no one wants), it can be maliciously replaced, like happens with hashing. (BTW, do you still support non-javascript users beside search bots? those bots don't login!)
comment Why disable JavaScript in Tor?
There are some ways from this question, but Tor disables those even with JavaScript enabled, like disabling WebRTC and detecting some bad behaviors.
comment Why doesn't DNS spoofing work against an HTTPS site?
One thing about this: it's common in my country to people ignore those warnings because our government CA isn't installed by default in browsers. It's security hole here, I don't know about other countries. In the other hand: use HSTS to disable the possibility to ignore the warning, better if pre-loaded.
comment Unsubscribe safely
Seems that title is a quite simple: I thought it was about how to implement a secure unsubscribe link when I saw it in Hot Network Questions.
comment How do I verify that WhatsApp is using end-to-end encryption?
@Ulkoma What if I text it to myself? (i.e. other device of mine) There's a law against that? Can I just say I was just taking a note about your comment?
comment Identicon for SSL certificate
Does someone already suggested to be implemented in a browser, beside the one cited? Some browser, like Chrome, could show it when users click "Advanced" on a SSL error. Maybe also show a button to permanently trust the certificate ( like Mozilla do ) when it repeats after some time. Of course it needs to be disabled when HSTS is used.
comment when is it safe to click through an SSL warning message?
I don't know why browsers don't make that last point easier: even if there is free and trusted HTTPS using proxy servers (like CloudFlare) the proxy server itself is a point of failure. Making easier to check authenticity for unknown CAs and self-signed certs is a good alternative or not? Like showing a randomart when the users show that he "understand the risks".
awarded  Announcer
awarded  Supporter