2,148 reputation
424
bio website pwnhome.wordpress.com
location Earth
age
visits member for 3 years, 8 months
seen 5 hours ago

"I like turtles"


2d
comment How can common users defend against the StageFright vulnerability?
Install TextSecure, it isn't vulnerable to this attack. As an added bonus, you can get end-to-end encrypted texts.
Jul
25
comment Why is my internal IP address (private) visible from the Internet?
The second chrome extension you linked to appears to work fine for me.
Jul
24
comment How can I find the origin of an IP address for a relayed IP?
What are you going to do if you find the IP address? Chances are, you can't. It is so easy to cover your tracks when doing something like this. Better just get the backend fixed as soon as possible.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry In fact, look at this comment. You sure you don't have two accounts :)
Jul
24
comment Using RSA for Web Application Authentication
BTW, just found this question you may be interested in.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry, true, true. Another possibly cool option would be to have the ssh connection (in addition to establishing the tunnel) return a one-time-use auth token for the user. Not sure how that would be passed to the browser, though.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry if an attacker can inject javascript, and the private key is loaded into the javascript memory, they can also get it. That to me is a bigger concern since then they could establish the SSH connection. But you did say you weren't worried about protecting the server from malicious clients :)
Jul
24
awarded  Talkative
Jul
24
answered Using RSA for Web Application Authentication
Jul
24
comment Using RSA for Web Application Authentication
Let us continue this discussion in chat.
Jul
24
comment Using RSA for Web Application Authentication
How does the browser get access to the SSH-RSA key pair?
Jul
24
comment Using RSA for Web Application Authentication
What's a threat model? well, you've already started building yours by answering my questions. You are not worried about protecting clients from a malicious server and not worried about protecting the server from malicious clients.
Jul
24
comment Using RSA for Web Application Authentication
You should definitely read What's wrong with in-browser cryptography? and Javascript Cryptography Considered Harmful
Jul
24
comment Using RSA for Web Application Authentication
"...and presents the end result to the server for authentication", how do they do that? What are your security goals? Mutual authentication, client-side authentication only? What is your threat model? Do you want to protect the clients from a malicious server? Server from malicious clients? Etc.
Jul
24
comment Why is my internal IP address (private) visible from the Internet?
There are a few chrome extensions out there to block this. E.g. webrtc-leak-prevent
Jul
20
comment How is 4G LTE encrypted?
Unfortunately, it seems that all of the links in this answer are broken. The first 2 return 404's, the last two never loaded for me.
Jul
17
reviewed Reject Monitor websites being visited on network
Jul
17
comment Guessing random bit with 100% accuracy
"at some point, the operator who runs the experiment loses patience" +1 for using the operator :)
Jul
16
comment How to encrypt columns in a database and be able to easily change encryption key
Define "easily". If I write a script once (even if it is fairly complicated) and all I have to do is run it every n months, to me that is easy.
Jul
16
answered where to store the salt for “crypto_pwhash” in a web application with no local storage