Reputation
58,865
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.3m people reached

Sep
5
comment How does a new SMS message overwrite a previous one?
@Ramhound Sure, until the logs expire. Providers only cache them for a short time after delivery is confirmed.
Sep
5
comment Building list of vulnerabilities that should be verified during pentest
OWASP is for generic descriptions of vulnerabilities, and advice on how to prevent / mitigate them. It's useful for background knowledge, but it doesn't really directly help identify vulnerabilities in systems, or document specific instances of known vulnerabilities.
Sep
5
comment Are Java applets more secure than regular forms for login?
Clearly not.
Sep
4
comment Bypassing the BIOS password
@Iszi The BIOS reset jumper doesn't always reset the password. Sometimes it's on an external NVRAM IC.
Sep
4
comment Verify Login and Encrypt with PBKDF2
@John My point is that if AES-128 is found to be broken in future, the fact that you're incorrectly validating the "TEST" string as correct would be the least of your worries, since your entire data is compromised.
Sep
4
comment Where does SSL encryption take place?
@Bruno I've added an update to reflect the comments.
Sep
4
comment How to set up a user-friendly NAS encryption?
Normally they prevent such problems by digitally signing the firmware package, so that only official firmwares can be installed.
Sep
4
comment Is SHA1 better than md5 only because it generates a hash of 160 bits?
@asudhak By the way, I don't know what context you're asking this question in, but do not use a hash like MD5 or SHA256 for passwords. See how to securely hash passwords? and how to store salt? for more detailed explanations.
Sep
4
comment How to set up a user-friendly NAS encryption?
Wow. The real solution would be to ditch the NAS and get one without such a horrific vulnerability!
Sep
4
comment Cohen's problem
Excellent answer, with a great example too. I hadn't heard of this problem. I guess Turing-completeness factors into this too?
Sep
4
comment Where does SSL encryption take place?
@Bruno I'm not sure I get what you're saying. TCP/IP is a suite of network protocols, whereas TCP and IPv4 are distinct protocols at individual layers in the OSI model. The OSI model makes a good abstraction in this case, because it shows where SSL sits. It doesn't need to be 100% accurate - nothing ever is with such abstractions - it's just there to aid understanding.
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Alright, TrueEquineVoltaicCellRivet then! ;)
Sep
3
comment Token-based authentication - Securing the token
Configure the client and server HTTPS implementations to reject weak ciphers and TLS downgrades. It's platform dependant, so you'll need to do some googling.
Sep
3
comment Token-based authentication - Securing the token
Yup, you should be fine if it's over HTTPS and your client refuses invalid certificates / weak ciphers.
Sep
3
comment Token-based authentication - Securing the token
@James Sorry, misunderstood the question. The mechanism you linked is fine for this kind of situation, but it will not protect you against replay attacks. You need to use something like SSL to prevent MitM / replay.
Sep
3
comment Token-based authentication - Securing the token
@James When the user comes to the site and does not have a session, the cookie token is sent to the server. The server validates it, creates a new session as the logged in user, and invalidates the token. It then gives the user a new token. The session identifies them whilst they're using the site, but when they close their browser (or the session expires) the user is no longer logged in. When they come back, they have no session, and the new token you gave them allows you to create a new session (go back to step 1)
Sep
3
comment Bypassing the BIOS password
+1 for that Arduino project. I actually considered that as an option, but it seems someone beat me to it! :)
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Or correcthorsebatterystaplecorrecthorsebatterystaple1234
Sep
3
comment Tracking stolen laptop which has a login password
@FrankPresenciaFandos Try switching to TrueCrypt's system encryption. It allows you to completely encrypt the disk, and have it decrypted at boot via the TC bootloader. This ensures that your entire disk is safe, including the OS and any swap file you might have.
Sep
2
comment What is a good practical (and sane) way to manage all your passwords for online sites?
You can store your password archives on DropBox or an equivalent service. Besides, your archive should be backed up along with your data. You do have backups, right? ;)