4,012 reputation
3925
bio website
location
age
visits member for 3 years, 5 months
seen Mar 23 at 16:18

I feel like most of the people saying they have been hacked are only paranoid. While most of the people who actually have been hacked do not notice it at all.


Mar
16
comment Is it legal to start a private website for you and your friends to hack?
@BennettMcElwee Germany. See security.stackexchange.com/a/83664/5518 Also free wifi is illegal here. But otherwise it's a nice country ;)
Mar
13
comment Is it legal to start a private website for you and your friends to hack?
@BennettMcElwee In my country it is illegal to give legal advice without been a lawyer. I am forced to mention that I am not a lawyer.
Mar
12
answered Is it legal to start a private website for you and your friends to hack?
Mar
6
answered Demonstrating SQL injection
Feb
25
comment Android app using FTP
HTTP is open as FTP so everybody can see what you are doing, steal accounts and upload files. SSL normally cost money but you can get a free SSL certificate yourself. Maybe your hoster will add this for free.
Feb
19
answered Is “password knocking” a good idea?
Feb
10
comment How to uniquely identify users with the same external IP address?
HTTP headers can be easily be changed by the attack. Captchas are annoying. I would recommend light throttling.
Feb
9
comment Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?
@SilverlightFox It might not have the official status yet but other functions are recommended for password hashing. I think card numbers are just like weak passwords that can be brute forced. But you are right SHA1 is not weak. It just not optimal in this use case.
Jan
29
comment Are passwords comprised of key sequences on a keyboard any less secure than the same characters but jumbled up?
@ToniLeigh pass-phrases are great. Also password manager and public/private key systems as ssh uses are possible options.
Jan
27
comment Is a fake base station needed for IMSI catching?
Yes, but the questions is: Do the attacker need the fake a network cell if he only likes to get the phones IMSI? Couldn't he sniff the phones ID from normal traffic? Meaning: Is the IMSI encrypted?
Jan
27
answered Are passwords comprised of key sequences on a keyboard any less secure than the same characters but jumbled up?
Jan
27
awarded  Curious
Jan
26
asked Is a fake base station needed for IMSI catching?
Jan
14
answered Detecting Hardware keyloggers… elegant solutions?
Jan
13
answered Passing session id in query string to maintain state in third party iframe - good practice?
Jan
9
comment Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?
In both cases you have a secret pepper or password (1. barrier). But yes with slow hash + pepper you are more secure as with a symmetric encryption like AES. The 2. barrier would be to brute force the slow hash function.
Jan
9
asked Any problems with scrypt yet?
Jan
9
answered Are credit card number look ups more secure with a hash function than with a deterministic encryption algorithm?
Jan
9
comment Storing plaintext passwords for cameras - Security concerns?
You can't add your key because there is no such list. Nor does the camera add a key from the server by itself. Only the owner with a valid key can tell the camera to add a key. Depending on implementation, you might be able to trick the camera owner to add your key but you can't automate this. But you are half right. If the public keys are stored on the server, the customer might not be able to verify what key he is adding...
Jan
9
awarded  Nice Answer