404 reputation
48
bio website
location Georgia
age 31
visits member for 2 years, 8 months
seen 2 days ago

Apr
11
comment Why does TLS need an explicit heartbeat protocol?
@Lukas - It wasn't detected because the bug wasn't in every version of OpenSSL.
Apr
11
comment Using client certificates for website authentication
There might be. What has your research shown?
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
@gowenfawr - I can't even tell what version that advisory effects and what version fixes the reported problem. I consider myself to be a smart individual, didn't realize RHS backpatched it granted, but holly cow that advisory is complete non-sense.
Apr
11
comment Should I cancel my current credit card because of heartbleed vulnerability?
I would say it depends. Most credit card companies won't hold you responsible for something like this. Your credit card would have only been compromise when you submitted the form, in most cases, what actually is stored is just an authorization token. Granted ALL traffic from the compromised certificate could be decrypted, the amount of data your talking about, would be enormous.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
Please dive deeper into the reason its useless because its not useless otherwise hundreds of thousands of very smart people wouldn't have enabled it and it wouldn't have even been developed.
Apr
11
comment Why can't we create a new SSL implementation?
The main reason? The current SSL specification standard isn't flawed. How its implemented in specific cases is flawed. There is a difference. Besides if people used Perfect Forward Secrecy this wouldn't be a problem. The big guys actually already do, except Yahoo, but Yahoo also transited everything within their network in plain text until a few months ago.
Apr
11
comment How vulnerable is Windows 7 to brute force attacks?
First; I guarantee you can process more then 3,000 attempts per second. Second what did you hear exactly and where did you read it? Third; Use LoginUser in your C program. We won't be giving you code.
Apr
11
comment How does a hacker use the heartbleed bug?
The blog goes into detail how the compromise works. What specifically don't you understand about the bug itself?
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
If you have 1.0.1e installed and versions up to 1.0.1f are vulnerable then your version is currently vulnerable. If you even THINK you are vulnerable you should update OpenSSL and revoke your certificate. You can also disable the SSL/TSL Heartbeat feature as an additional security measure
Mar
8
comment Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form?
Why would you want an a blob of encrypted data?
Mar
4
comment Are virtual keyboards themselves secure?
Why don't you just use the virtual keyboard built into Windows?
Jan
29
comment Does two-factor authentication reduce the need for a long password?
What does your security on your google account have to do with the security on another website have to do with one another? Long passwords are to avoid the brute force attack
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
@FranciscoPresencia - If either salt was known they would be able to brute force the user's password because all you did was hash it twice with two separate salts. The simplest of the passwords will be brute forced.
Jan
11
comment PC showed evidence of a phone being attached for no obvious reason. Theories on why?
I don't understand the question. This simply sounds like a phone was connected to the computer.
Jan
11
comment Using skype for an attack
@SomeNickName - You forgot to mention the fact that a malicious person having just your ip address is not a threat. They would also need to know they can compromise using a known vulnerability with software on the machine. In most cases any attack like this can be blocked by a router.
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
The compromise of either salt would lead to the ability to determine the user's password.The fact you store the hash from two separate salts won't change this fact.Your user's passwords still are vulnerable to a single brute force attack. I would say that your better off protecting the account and the contents by allowing these Facebook/Google/Microsoft protect their user's account.This allows your users to decide how best to protect their account with you. Most providers support authenticators allowing additional protection. You being compromise still keeps their ftp information protected.
Jan
3
comment I don't understand how BIPS got hacked
One should not tile out that the only true part of the story was the DDOS attack and the owners simply took the BTC. The price of BTC in Nov was a great deal more then it is today
Oct
25
comment Are there any potential security risks in connecting to a Murmur (Mumble) server?
Only those that are within the client your using to connect to the server.
Sep
26
comment Is it illegal to use Fake User-agents?
There is no way to prove you faked an agent if the agent you faked was a valid agent.
Sep
26
comment Is it illegal to use Fake User-agents?
How would they prove you faked the agent unless the fake agent was an invalid agent (although you can recompile firefox or chrome ) so then you couldn't prove anything. In other words there is no way to prove you faked an agent.