2,825 reputation
21223
bio website
location
age
visits member for 3 years, 10 months
seen Jun 25 at 11:47

May
22
comment How bad is a source code leak for an antivirus?
@schroeder "By 'free' I assume you mean 'open source'." yes (or just source code is accessible). I have in mind a ridiculously obvious null-dereference bug in the linux kernel that went unoticed; now, a missing break in sudo! If such obvious bugs are not seen, then I don't believe in code review to detect more subtle problems caused by interaction between components (like unwanted race conditions). To me it proves that in practice most source code is almost never read. There is just too much of it, and it's increasing.
May
21
comment Securing private IP space
Which RFC 5735 range do you use?
May
21
comment Securing private IP space
"The expected configuration is, in almost all of these cases, is to have the gateway at either 192.168.0.1 or 192.168.1.1." It may be possible to access the gateway configuration via its public IP address.
May
21
comment Securing private IP space
"They are very weak against a dedicated attacker, and so should not be relied upon as the only security functions in your system." Can you make efforts to install multiple layers of protection without the sentiment that it will significantly help security? I believe that an effort generates its own psychological reward: the sentiment that whatever one does what useful. It is thus IMO very difficult not to believe that this will significantly improve the security situation. So I think that it will in some way be relied on. Even for a nuclear plant I would not do this "in depth" thing.
May
21
comment How bad is a source code leak for an antivirus?
Would knowing the "heuristic based algorithms" also help the writers of legitimate software to avoid triggering a false positive?
May
21
comment How bad is a source code leak for an antivirus?
@schroeder "code review is far easier and more efficient than fuzzing" Is that your personal experience tells you, or your intuition? Why are free software not attacked a lot more than closed source software?
May
18
comment How do I protect myself against 'hole 196'?
@Rook The proof that you can set-up a rogue AP is that you can set-up a legitimate AP. The source is "anyone who has configured a Wifi AP". (A rogue AP is any AP that you do not consider legitimate.)
May
18
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
@cx42net My point is: there is no thread model here. The OP wants to disallow a bunch of things, but without a threat model, these is nothing to discuss.
May
17
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
@cx42net "It's not about a threat (my comment) but an useless act." so, there is no threat model here?
May
17
comment How do I protect myself against 'hole 196'?
@Rook A source for what statement? Again, the PSK is the only secret master key in the whole ESSID. All other informations are sent in clear-text in the air, or derived from the PSK and informations sent in the clear. Once you have given the PSK to a double-agent, you pretty much have an open unencrypted WLAN - inside a Faraday cage (outsiders cannot connect to the WLAN).
May
17
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
@cx42net It isn't clear why the OP thinks it is necessary, or even useful, to prevent the legitimate user from copying the URL. What is the threat model here?
May
17
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
+1 Some users will post a copy of the browser windows to forums, revealing the URL (I have seen it). Some users will actually post the URL as text (I have actually witnessed that a few times). Many users do not understand that a URL sometimes contains sensitive information.
May
17
comment How do I protect myself against 'hole 196'?
Knowing the PSK you can even setup a rogue AP that cannot be distinguished from the legitimate ones: clients could detect a BSSID change, but they cannot assume that there is only one AP for a given SSID as many AP could be part of the same ESSID. Of course the BSSID could also be cloned. Conclusion: WPA*-PSK offers zero protection against insiders. Use WPA-Enterprise.
May
16
comment How do I protect myself against 'hole 196'?
@drjimbob "eavesdropping by others which most modern networks with a star based topology would not allow" unless by "most modern networks with a star based topology" you mean "switched Ethernet with specific security features that prevent DOS on the switching logic as well as ARP poisoning", this is not true. "Most wifi setups do not use RADIUS authentication servers, instead opting for (often-weak) pre-shared keys" If they buy such professional-grade Ethernet switch, why do they use WPA-Personal with a weak passphrase? It is hard to believe that they fear wired more than wireless.
May
16
comment How do I protect myself against 'hole 196'?
@drjimbob "If an insider didn't intercept the initial nonce" then all they have to do is to force dissociation.
May
16
comment Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
"Hole 196" is a hole only if you have insane expectations for an "open" thing.
May
14
comment How do I protect myself against 'hole 196'?
@drjimbob "Wifi makes it trivial for anyone nearby to eavesdrop or interfere" Obviously, "open" (cleartext) Wifi is trivial to attack for anyone in range. "and only starts to be comparable in security" Which "security" properties? As you said, encrypted Wifi is still detectable and can easily be jammed (and some people even say it gives you cancer!). It all depends on the security properties you need. I am happy to let my neighbours know I use Wifi, and they never tried to jam my signal (my MW oven tried to jam my Wifi, but then changed channels).
May
14
comment when is it safe to click through an SSL warning message?
@Misha "if you have visited it before (even if your use this time is non-confidential browsing, say), because it will have access to HTTPS-only cookies for that domain?" before, and after!
May
14
comment when is it safe to click through an SSL warning message?
"On a theoretical point of view, an HTTPS site with a warning on the certificate is no better, but no worse either, than a plain HTTP site." Sorry, this is not correct from a purely theoretical point of view. Accepting the unverifiable certificate is a global change to the browser, it impacts not only the current browsing context, but the HTTP/HTTPS engine used by the browser for every other website. You may think that accepting a certificate for a website you do not trust (or even know about) is safe, but that intuition is wrong. This domain may be used by another, trusted website.
May
14
comment How do I protect myself against 'hole 196'?
@drjimbob Indeed. You should always go directly to the https URL. You should bookmark this URL, not the HTTP URL. The HTTP URL should immediately redirect to the HTTPS URL, so people don't have a chance to bookmark it. You can also define as HTTPS-only with a header whose spelling I forgot. Anyway I do not think that the Web browser should be used for anything really sensitive unless it is totally castrated to only be able to access a few trusted servers.