curiousguy

1,721 reputation

1614

bio	website
	location
	age
visits	member for	1 year, 8 months
	seen	6 hours ago
stats	profile views	301

	1,721 reputation	bio	website		visits	member for	1 year, 8 months
1614 badges		location			seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

953 Actions

suggestions reviews revisions comments badges posts accepts all

Sep 14	comment	XSS : Blacklist characters vs. whitelist "You may even try if a mailserver accepts the user (Gmail will error when a user does not exist, even before you really sent anything)" do you suggest verifying email validity with `RCPT TO` instead of the command intended for this (`VRFY`)?
Sep 14	comment	Could browsers improve security of stored passwords by using setuid? "One of my favorite context ideas is preventing even root from reading /etc/shadow," root can still change its own password, I believe.
Sep 13	comment	Javascript Malware: How does it work, and how can it be mitigated? "Windows User Account Control is one of the best techniques because of how it interrupts every other program when it needs privileges to complete a task." The UAC interface can easily be faked by a local process.
Sep 12	revised	Does the following data stream look secure to you? edited tags
Sep 12	comment	Are SSL encrypted requests vulnerable to Replay Attacks? @CodesInChaos "I know protocols which have everything you mention, and still suffer from replay attacks" protocols implementing a message sequence abstraction? (ordered stream)
Sep 11	awarded	Nice Answer
Sep 10	comment	HTTPS Sensitive Information and Caching @John Reply updated.
Sep 10	revised	HTTPS Sensitive Information and Caching edited tags
Sep 10	comment	HTTPS Sensitive Information and Caching See also Why both no-cache and no-store should be used in HTTP response?.
Sep 10	revised	HTTPS Sensitive Information and Caching Added reply to updated question
Sep 10	answered	HTTPS Sensitive Information and Caching
Sep 9	answered	Could browsers improve security of stored passwords by using setuid?
Sep 8	revised	Is OpenVPN secure if both the certificate and private key, are publicly known? Edited title
Sep 8	suggested	suggested edit on Is OpenVPN secure if both the certificate and private key, are publicly known?
Sep 8	revised	Is OpenVPN secure if both the certificate and private key, are publicly known? edited tags
Sep 7	comment	How to verify correct, secure and test setuid? @RichardBelisle For every SUID that you turn off, there is a potentially useful functionality that is broken. "The following files should have their setuid or setgid bits disabled unless required." It can be very difficult for unexperienced users to determine what is required for what purpose. After changing a file permissions, you might observe that some functionality fail to work in an obvious way, or in a subtle way.
Sep 7	answered	How to verify correct, secure and test setuid?
Sep 5	comment	Effectiveness of Security Images @drjimbob I had the impression that most phishing attempt used a fake link in a fake email. "(Or a proactive bank could purchase and enable HSTS for similar domain names)." So similar that the user might type the other name by accident, yes (`my-bank.com` vs `mybank.com`); but not confusingly similar based on lack of understanding of the DNS name spaces (`mybank.login.secure.banking.something.com`)
Sep 5	comment	Effectiveness of Security Images @Ramhound "They would need to know WHICH security image you actually selected." Obviously. "It doesn't actually sound like you know how javascript works." I do, actually. "If they already have the ability to pull YOUR security image for your bank account, then they already have ALL the information they need, to access your bank account." Nonsense.
Sep 5	comment	Effectiveness of Security Images @drjimbob "as well as HSTS" HSTS is only effective on the exact same domain, see `my-bank.com` vs `mybank.com` vs `mybank.secure-server.com`.