2,375 reputation
11019
bio website
location
age
visits member for 2 years, 11 months
seen 16 secs ago

1d
comment Is this hash function safe?
@Polynomial 1 is a most descriptive term than sizeof(char).
2d
comment Is this hash function safe?
@Polynomial "that the size of the type is relevant" of which type? Why not sizeof (sometypedef)?
Aug
24
comment How vulnerable am I on a unencrypted public WiFi network?
WPA-Personal with a PSK shared with strangers is not very secure obviously; still, you at least get a session key, which allows encrypted unicast from/to AP. Of course, only symmetric encryption is used, based on a shared secret, so anyone could capture and decrypt the auth phase and recover the private session key. But 1) this requires some effort (more than trivial listening on open Wifi) 2) only those who captured the encrypted session key packets can do the decryption. So WPA-Personal provides some obfuscation. But you should move to Enterprise mode instead.
Aug
22
comment Is this hash function safe?
sizeof(char) is 1. Always. By design. By definition. Don't compute sizeof(char).
Aug
2
comment Can the USB standard be fixed to prevent the “firmware attack”?
@nealmcb Probably, but you would first need to configure the networking device; maybe with the keyboard and pointing device included in the same USB chip?
Aug
1
comment Can the USB standard be fixed to prevent the “firmware attack”?
@nealmcb "can launch networking attacks" how?
Aug
1
comment Can the USB standard be fixed to prevent the “firmware attack”?
USB isn't a standard about flash memory design, or mouse design, it's a networking standard. A networking standard, even PXE, has no business ruling on loader signature, kernel signature, etc.
Aug
1
comment Can the USB standard be fixed to prevent the “firmware attack”?
I have no idea what you would like to standardise. I bet firmware, firmware loaders, and chips are not standard. A USB standard's aim is interoperability, not security. It's about standard protocols. If people want to play and reprogram USB devices, it isn't the task of a standard to rule on that.
Aug
1
comment Can the USB standard be fixed to prevent the “firmware attack”?
How devices can be reprogrammed, how new firmware is verified, and whether it is signed, are out of the scope of the standard.
Jul
15
comment This protocol is vulnerable, but why?
It isn't clear what you are trying to do here!
Jul
14
comment Why is the same origin policy so important?
"origin of the script itself is not relevant to the same-origin policy" but it is: first, the script http://a.c/s.js is fetched with its HTTP origin http://a.c, with its a.c HTTP cookies; then run within the scope of the HTML document (http://b.c/doc.html) HTTP origin (http://b.c/).
Jul
13
comment Showing CAPTCHA
With IPv6, getting another, different IP address is as trivial as ipconfig. Be careful with address storage: don't expose yourself to a DDOS.
Jun
16
comment Is it illegal to publish an exploit against a known vulnerability in US?
@AbbasJavanJafari OSS (open source software) is not without copyright and copyright owners.
Jun
14
comment Is it illegal to publish an exploit against a known vulnerability in US?
Could you describe the applicable doctrine or law?
Jun
14
comment Is it illegal to publish an exploit against a known vulnerability in US?
@schroeder "It's a defined concept" But can you prove to a judge that you did a "responsible disclosure"? Can the other party disprove that?
Jun
13
comment Is it illegal to publish an exploit against a known vulnerability in US?
@schroeder Is "responsible disclosure" a well defined concept?
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@makerofthings7 "Google leaks search terms to the target site" not anymore
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
Re: referer You can search for "referer.rustybrick.com" in a search engine and click on the link to see how much info is sent. For Google and DDG, I see only the website (https://google.com/, https://duckduckgo.com/). For Bing, I see lots of stuff. (I use Google Chrome.) Note that this would work with a HTTP website, because referer is usually not sent in this case.
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
I dislike the change-HREF-when-clicked but I disagree about Google trying to hide the fact that selected linked are logged: I have a Google account, and under Search history I can see 1) the searches I have made, 2) the websites I have visited by clicking on Google search results. (I wished Google used the PING feature to collect this data, and not mess with URLs, and I wish browser would show PING requests in some way.) You have to remember that when you have JS on, everything you type or click on a website can be logged by the website, including form data when you do not "submit".
Mar
7
comment Should websites be allowed to disable autocomplete on forms or fields?
1. Some computers get stolen on a daisy. These should have adequate passphrase protection. 2. A CEO is not a system admin and breaking into his account should not have any notable security impact for the information system.