2,224 reputation
1917
bio website
location
age
visits member for 2 years, 6 months
seen yesterday

May
22
awarded  Taxonomist
May
15
comment Are CSRF Attacks Really Blind
What should parse as CSS (according to std), exactly? I have really no idea. What does parse as CSS, in real world browsers? What might parse in the future? I am not sure. I am just unsure, and it is unpleasant. The mere fact that I might have to worry about a potential, unlikely, problem is annoying. I like to be able to make security proofs not rely on how unlikely it is that something sensitive might parse as CSS, someday.
May
15
comment Are CSRF Attacks Really Blind
"stylesheet, but can't programatically access its contents" Can't you get the "computed" style of your own page elements? That would tell you something about the included CSS.
Apr
8
awarded  Nice Answer
Apr
1
comment Does “loose source and record route” drop the source address?
+1 for mentioning using loose source routing for stateless "NAT"
Mar
29
comment Security issues with allowing Dropbox installations on client PC's in our organisation
"Payment Card Industry (PCI) Standards says so" why would you even want to handle Payment Card data? That is the job of banks and other specialized payment operators! IMO most company should not even think about handling these sensible information themselves. If they do, it should be on isolated computers, such that file sharing software can be installed on other computers without any risk for payment data.
Mar
29
revised Does “loose source and record route” drop the source address?
edited tags
Mar
29
revised How do browsers know which cookie to get?
edited tags
Mar
21
comment Does Google Chrome protect against cross site scripting (XSS)?
XSS prevention in browser is a potentially very dangerous feature if it blocks specifics scripts classified as XSS, if these scripts have security sensitive functions.
Mar
6
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
@culix "Does that make sense?" It does. But how do you know you have logged out?
Feb
12
awarded  Notable Question
Feb
1
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
@LieRyan "If the device is compromised, the bank can simply issue a new device with a new seed" I mean if the device you use to connect "securely" to your bank. "And the danger of compromising an active session always exists whatever auth method you use, so what's your point?" My point is that a compromise of your computer is probably the most likely practical threat.
Jan
30
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
But two factors auth does not protect your session.
Jan
30
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
@LieRyan If the device is compromised, there is no guarantee. Even if a password is not compromised, there is a valid session that can be misused directly.
Jan
28
revised Can a SMS recipient charge any arbitrary fee to the sender without approval?
edited tags
Jan
23
comment How is a worm different from a virus?
@GrahamHill An existing boot loader certainly counts as an existing program. What about a boot "virus" that installs itself on a floppy disk that was not bootable?
Oct
5
revised How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
edited tags
Sep
24
awarded  Yearling
Sep
21
awarded  Custodian
Sep
15
awarded  Fanatic