curiousguy

1,743 reputation

1614

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	5 hours ago
stats	profile views	307

	1,743 reputation	bio	website		visits	member for	1 year, 9 months
1614 badges		location			seen	5 hours ago

summary answers questions tags badges favorites bounties reputation activity

700 Comments

suggestions reviews revisions comments badges posts accepts all

May 15	comment	Are CSRF Attacks Really Blind What should parse as CSS (according to std), exactly? I have really no idea. What does parse as CSS, in real world browsers? What might parse in the future? I am not sure. I am just unsure, and it is unpleasant. The mere fact that I might have to worry about a potential, unlikely, problem is annoying. I like to be able to make security proofs not rely on how unlikely it is that something sensitive might parse as CSS, someday.
May 15	comment	Are CSRF Attacks Really Blind "stylesheet, but can't programatically access its contents" Can't you get the "computed" style of your own page elements? That would tell you something about the included CSS.
Apr 1	comment	Does “loose source and record route” drop the source address? +1 for mentioning using loose source routing for stateless "NAT"
Mar 29	comment	Security issues with allowing Dropbox installations on client PC's in our organisation "Payment Card Industry (PCI) Standards says so" why would you even want to handle Payment Card data? That is the job of banks and other specialized payment operators! IMO most company should not even think about handling these sensible information themselves. If they do, it should be on isolated computers, such that file sharing software can be installed on other computers without any risk for payment data.
Mar 21	comment	Does Google Chrome protect against cross site scripting (XSS)? XSS prevention in browser is a potentially very dangerous feature if it blocks specifics scripts classified as XSS, if these scripts have security sensitive functions.
Mar 6	comment	Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @culix "Does that make sense?" It does. But how do you know you have logged out?
Feb 1	comment	Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @LieRyan "If the device is compromised, the bank can simply issue a new device with a new seed" I mean if the device you use to connect "securely" to your bank. "And the danger of compromising an active session always exists whatever auth method you use, so what's your point?" My point is that a compromise of your computer is probably the most likely practical threat.
Jan 30	comment	Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? But two factors auth does not protect your session.
Jan 30	comment	Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @LieRyan If the device is compromised, there is no guarantee. Even if a password is not compromised, there is a valid session that can be misused directly.
Jan 23	comment	How is a worm different from a virus? @GrahamHill An existing boot loader certainly counts as an existing program. What about a boot "virus" that installs itself on a floppy disk that was not bootable?
Sep 14	comment	XSS : Blacklist characters vs. whitelist "You may even try if a mailserver accepts the user (Gmail will error when a user does not exist, even before you really sent anything)" do you suggest verifying email validity with `RCPT TO` instead of the command intended for this (`VRFY`)?
Sep 14	comment	Could browsers improve security of stored passwords by using setuid? "One of my favorite context ideas is preventing even root from reading /etc/shadow," root can still change its own password, I believe.
Sep 13	comment	Javascript Malware: How does it work, and how can it be mitigated? "Windows User Account Control is one of the best techniques because of how it interrupts every other program when it needs privileges to complete a task." The UAC interface can easily be faked by a local process.
Sep 12	comment	Are SSL encrypted requests vulnerable to Replay Attacks? @CodesInChaos "I know protocols which have everything you mention, and still suffer from replay attacks" protocols implementing a message sequence abstraction? (ordered stream)
Sep 10	comment	HTTPS Sensitive Information and Caching @John Reply updated.
Sep 10	comment	HTTPS Sensitive Information and Caching See also Why both no-cache and no-store should be used in HTTP response?.
Sep 7	comment	How to verify correct, secure and test setuid? @RichardBelisle For every SUID that you turn off, there is a potentially useful functionality that is broken. "The following files should have their setuid or setgid bits disabled unless required." It can be very difficult for unexperienced users to determine what is required for what purpose. After changing a file permissions, you might observe that some functionality fail to work in an obvious way, or in a subtle way.
Sep 5	comment	Effectiveness of Security Images @drjimbob I had the impression that most phishing attempt used a fake link in a fake email. "(Or a proactive bank could purchase and enable HSTS for similar domain names)." So similar that the user might type the other name by accident, yes (`my-bank.com` vs `mybank.com`); but not confusingly similar based on lack of understanding of the DNS name spaces (`mybank.login.secure.banking.something.com`)
Sep 5	comment	Effectiveness of Security Images @Ramhound "They would need to know WHICH security image you actually selected." Obviously. "It doesn't actually sound like you know how javascript works." I do, actually. "If they already have the ability to pull YOUR security image for your bank account, then they already have ALL the information they need, to access your bank account." Nonsense.
Sep 5	comment	Effectiveness of Security Images @drjimbob "as well as HSTS" HSTS is only effective on the exact same domain, see `my-bank.com` vs `mybank.com` vs `mybank.secure-server.com`.