1,824 reputation
315
bio website pwnhome.wordpress.com
location
age
visits member for 2 years, 5 months
seen 14 mins ago

"I like turtles"


2d
comment Downloading list of pinned certificates
what if the self-signed cert if ever compromised (e.g., via a heartbleed like attack).
2d
answered How do I hack this login page by using SQL injection?
2d
comment How do I hack this login page by using SQL injection?
You probably get "Your account has been blocked" because the first account in the DB is blocked. You could get the second item in the returned set by trying LIMIT 1,1 (if it is mysql).
Apr
18
comment Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?
@jaysheth It would sound like you were probably safe then.
Apr
18
comment OpenSSL Code Review
It appears the answer is yes (blog.bugcrowd.com/open-letter-to-internet-users-and-businesses)
Apr
18
comment What happens if biometric data is stolen?
@TimDeng I think those are all valid questions that system designers should ask themselves. I think biometrics for authentication became popular because of how cool it sounds. Just scan your finger or eye and you get access. I see some use for them in local authentication with a tamper-resistant sensor (then you'd physically have to remove someone's finger or eye or construct a very good prosthetic).
Apr
17
answered What prevents me from using ARP poisoning to force a client to use HTTP?
Apr
17
answered Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?
Apr
16
answered What happens if biometric data is stolen?
Apr
16
revised What happens if biometric data is stolen?
added a tag and removed unnecessary fluff.
Apr
16
suggested suggested edit on What happens if biometric data is stolen?
Apr
16
comment What happens if biometric data is stolen?
There has been some work where your biometric is used as your public key. Then it doesn't matter if your biometric data is stolen as that is your public key. It uses IBE under the hood and some other things to deal with the fuzziness of biometrics.
Apr
15
comment Decrypt Passwords based on using a user's password
The best way would be to use a more secure delegation system (like OAuth). That way your customer's don't have to give you their credentials. It looks like 23andme supports OAuth (api.23andme.com/docs). Not sure if the other services you would need to access do, however.
Apr
15
comment Decrypt Passwords based on using a user's password
Let me see if I get this straight. The employee enters their password which gives them the key to encrypt/decrypt the customer's password. All employees will likely have different passwords though, correct?
Apr
14
awarded  Benefactor
Apr
14
comment Self-signed SSL certificate on chromebook (and android)
@SteffenUllrich I'll give you the bounty as I sent you chasing down a rabbit hole. Sorry about that.
Apr
14
accepted Self-signed SSL certificate on chromebook (and android)
Apr
14
answered Self-signed SSL certificate on chromebook (and android)
Apr
14
revised Is forwarding a port(s) a security risk to all computers on the network or just one?
fixed grammar, added tags.
Apr
14
answered Is forwarding a port(s) a security risk to all computers on the network or just one?