2,815 reputation
21223
bio website
location
age
visits member for 3 years, 10 months
seen Jun 25 at 11:47

Jun
14
comment Did this ShellShock exploit work?
Careful here! Shellshock is not a vulnerability, it's a collection of vulnerabilities. You can be immune from one but not the next one. Also, many people consider that the fact () { foo } can define a function IS already a vulnerability, as the attacker doesn't need to control the variable name.
Jun
9
comment Are passwords in Mozilla products stored insecurely?
What did you expect?
May
25
comment GET and POST request vulnerable to CSRF attack?
@NgocHuynh I have added tags for clarity
May
25
comment GET and POST request vulnerable to CSRF attack?
Is the client a web browser?
Feb
14
comment Can any CA sign any domain?
Not if the CA is "too big to fail".
Feb
13
comment Are CSRF tokens useful outside of web APIs?
What is a "Web API"?
Jan
20
comment Why is a child window allowed to change the location of its parent?
On which browser?
Jan
16
comment What does the SSID have to do with a networks security concerning rainbow tables?
In the context of attacks against WPA/WPA2-Personal?
Jan
16
comment Why do coffee shops not use WPA/WPA2? Would it solve many problems if they did?
@user54791 WPA2-Enterprise does not imply "different username/password to each customer".
Jan
2
comment What things should I check for when giving a client control of the filename parameter to C's open() function?
Sidenote: sizeof(char) is 1 by definition.
Dec
15
comment Is TLS in Tor useless?
Do you value speed over privacy and security?
Nov
30
comment If a phone is encrypted at a platform storage level do I need to encrypt my data stored on it?
@sisterray The problem with a browser is that it is almost always used; if you app is used for short period of times, it might make sense to protect its data with a specific password.
Nov
30
comment If a phone is encrypted at a platform storage level do I need to encrypt my data stored on it?
@ParthianShot Unless you don't have your browser opened all the time (which would be quite exceptional), and you don't use need your passwords all the time (the remember password feature is useful when you have many passwords and use these often), and your little brother could still get your passwords and use your online accounts. Conclusion: Lock your computer.
Oct
22
comment How can I strip sensitive data out of a Wireshark log report?
There is probably much more than MAC addresses in the log file.
Oct
22
comment How can I strip sensitive data out of a Wireshark log report?
What kind of traffic?
Sep
11
comment Is it fair to say that lack of client-authentication in TLS implies no requirement of non-repudiation?
"non-repudiation" of what exactly?
Aug
28
comment Is this hash function safe?
@Polynomial 1 is a most descriptive term than sizeof(char).
Aug
27
comment Is this hash function safe?
@Polynomial "that the size of the type is relevant" of which type? Why not sizeof (sometypedef)?
Aug
24
comment How vulnerable am I on a unencrypted public WiFi network?
WPA-Personal with a PSK shared with strangers is not very secure obviously; still, you at least get a session key, which allows encrypted unicast from/to AP. Of course, only symmetric encryption is used, based on a shared secret, so anyone could capture and decrypt the auth phase and recover the private session key. But 1) this requires some effort (more than trivial listening on open Wifi) 2) only those who captured the encrypted session key packets can do the decryption. So WPA-Personal provides some obfuscation. But you should move to Enterprise mode instead.
Aug
22
comment Is this hash function safe?
sizeof(char) is 1. Always. By design. By definition. Don't compute sizeof(char).