Reputation
Next tag badge:
657/400 score
76/80 answers
Badges
19 169 262
Newest
 Nice Answer
Impact
~3.1m people reached

8h
comment How to not store the card during 3D Secure authentication, to be PCI DSS compliant?
I mean, the whole point of having a separate payment provider (and paying them for that service!) is to keep sensitive financial data outside the scope of your systems, allowing you to reduce regulatory compliance costs and complexities, and to reduce your ongoing security costs through risk reduction. If your payment processor is requiring you to handle unmasked credit card details at any point then they are failing to deliver on the service you're paying them for.
8h
comment How to not store the card during 3D Secure authentication, to be PCI DSS compliant?
My concern is this: "the user enter his card details on my website. The form posts to my server, which generates the web form for 3D Secure in step 1". I have never seen a site do this which wasn't itself a payment provider. The whole point of the form is that it's meant to be hosted by your payment provider to keep your systems outside of PCI DSS scope. Visa guidelines say to put the form in an iframe. Also, your verification step seems odd. Surely your provider signs status messages as proof of payment success, which should be sufficient and avoids you ever having the CC number?
11h
comment How could Craig Wright obtain Satoshi Nakamoto's private key?
This one time, at band camp, I invented a global cryptocurrency.
11h
comment Altering assembly without affecting digital signature
Can you upload the pre- and post-cracked file somewhere along with the crack itself so we can take a look? This sounds kinda hokey and I can't imagine a situation where the signature would remain valid (aside from re-application of a stolen cert or, potentially, a weak hash like MD5).
1d
comment Always setgroups before setuid?
@Kaz No, not at all. The process has an effective privilege set based on its stored gid and uid plus supplementary gids. When the process calls setuid it doesn't do anything to the gids; you have to change that yourself. By calling setgroups you can clear the stored gid and ancillary gids properly. Without doing that, your process still runs at the same effective gid as before.
1d
comment Always setgroups before setuid?
@Kaz A comparable case on Windows would be a process running as an administrative user which launches a thread that runs under an alternative security context via impersonation, without dropping a critical process-level privilege such as SeDebugPrivilege.
1d
comment Always setgroups before setuid?
@Kaz Alternatively, imagine you assign an ancillary group to root (uid 0) to provide it with administrative privileges on a particular feature on a service which doesn't give root administrative access by default. A binary which is setuid and owned by root will now have access to that group's privilege. If it doesn't drop that group, it will drop privilege to the uid of the user it calls setuid on, but still have access to that group due to the ancillary groups. By calling setgroups first it can properly drop that additional privilege.
1d
comment Always setgroups before setuid?
@Kaz Not quite. Imagine you have the setgid bit on a binary, and one of those groups is given the privilege to access X11 sessions. That binary wants to drop privileges, so it calls setuid to the current user who ran the binary. That user isn't in the X11 group. Now that user, through that process, has access to X11 when it didn't before. Calling setgroups with a single group (that of the target user) removes this issue.
1d
comment Always setgroups before setuid?
@Kaz In which case, the second half of my answer should cover what you want. Failing to drop the ancillary groups may imbue additional capabilities which would otherwise be lost when doing setgroups with a single non-zero gid (before setuid of course).
1d
comment How bad it is to feed /dev/random with /dev/urandom?
This answer is correct. There are many pervasive myths about /dev/random vs. /dev/urandom, but for all practical situations urandom is secure enough for almost any sensible security requirement, since it generates its output using a secure stream cipher (or a block cipher in a streaming mode). While re-seeding /dev/random with /dev/urandom isn't technically speaking a great idea (it somewhat invalidates the arguably meaningless difference between them) it doesn't do any practical harm.
1d
comment Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?
What issues, exactly, do you think this scheme suffers from?
1d
comment Single Page Application with REST API backend based on XML, queried by dynamic XPath
@DecentDabbler Just a quick Google search for "XML vulnerabilities" should give you an example, but the point is that there's so much to XML above and beyond its ability to store data in a nested structure. The more features and complexity you add, the more potentially vulnerable code there is. The fact that Wikipedia has an entire category for XML should give you an idea of how bloated the format and standard has become.
1d
comment Single Page Application with REST API backend based on XML, queried by dynamic XPath
@DecentDabbler That said, look into object injection attacks and the security issues around unserialising untrusted data. Both of these are of critical importance if you're deserialising this data into objects, from either XML or JSON, without appropriate checks. Again, if possible, avoid this kind of behaviour where possible due to its complexity and tendency for security bugs - manually pull out fields from the input data and fill the objects.
1d
comment Single Page Application with REST API backend based on XML, queried by dynamic XPath
@DecentDabbler In regards to the two additional questions, it's not something anyone here can answer. It's something that would be investigated interactively during a penetration test against the application (in fact, I quite regularly see questions such as this raised in statements of work in my day job). Regarding the JSON part, it's a much safer format in terms of its use for data storage and transfer - XML is an immensely complex markup language and its use for data storage is the result of many a vulnerability.
1d
comment Which is the correct algorithm while checksumming a portion of code?
@ak0817 I suggest you read into Kerckhoffs's principle / Shannon's maxim and security through obscurity.
1d
comment Single Page Application with REST API backend based on XML, queried by dynamic XPath
To whoever close-flagged this as "too broad", a long question does not make a question too broad. There are some clear and answerable questions here: what vulnerabilities are potentially present in this use of XPath and XML. The one close reason I could understand is the one relating to breaking a specific question, but I think that's arguable either way. I consider this a well-enough written and fleshed out question to remain here.
2d
comment Why won't Firefox accept my certificate?
@BaselSayeh I'm not sure that works. Try explicitly providing them in the subjectAltName.
2d
comment c# code to reset password in ms word document
Do your own work. Qualifications are meaningless if you don't earn them.
2d
comment Can someone know that I'm using a VPN if they have my MAC address?
This does not answer the question. A number of your answers are similar to this. Please try to actually answer questions in future rather than just suggesting an alternative product as a solution and ignoring the asker's direct concerns.
Apr
29
comment USB TEMPEST attacks: viable range?
I'm unaware of any papers, and any properly informed replies would likely have to involve a serious amount of research into the practicality of it. It's also going to be hugely variant on the individual implementation - something as trivial as the location and shape of ground and power planes might vastly alter the amount of EMI that's emitted.