Reputation
1,038
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 12
Newest
 Caucus
Impact
~37k people reached

Feb
20
comment Tamper proof hardware - not resistant
Old engineer's rule, "It is impossible to make anything foolproof because fools are so ingenious." Or to put it another way stated by a former boss, "I find his incompetence truly amazing, he's the only person I've ever seen break a ball bearing with a broomstick."
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
@ceejayoz - In a country that small with as many threats as they have to face, they don't have the luxury of running a volunteer army. BTW, the password to access the private cert is komodia. Expect exploits soon. Anything that uses Komodia software is vulnerable to the attack (Qustodio, Keep my Child Secure, etc.)
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
As a side note, the source for the SuperFish software is Komodia, a company formed by a former Israeli IDF Intelligence Core programmer. Who at the moment is claiming they are under attack per Forbes Magazine.
Feb
20
comment Why was the private key of the Superfish certificate so easily extractable?
Embedded as a string, hmm, so doing a strings search on the binaries would show it? I think the key was taped to the front of the safe in plain sight then.
Feb
19
comment Can serving HTTPS to Internet Explorer on Windows XP be made secure?
Call your local mortuary and look into the cost of cremation vs. burial, Windows XP is dead on the security front. As with IE 4 backwards compatibility back in the day, web developers across the board ceasing to support old, dead browser combinations is the quickest way of moving users into more secure environments. We didn't need to keep fluent in browser display hacks then, we shouldn't be accommodating browser/OS combinations that leave our customers vulnerable now.
Feb
17
comment Firmware Backdoor Protection
As a continuation of the threats given by firmware of all sorts, be prepared for all hard drives to be totally untrustworthy. The Equation Group hard drive firmware APT renders drive wiping to be easily applied soul salve that does nothing. Waiting for when it becomes a general production for all other malware. Rootkits will be a thing of the past, rooted firmware rules.
Feb
16
comment Why is it so hard to trace origins of DDOS attacks?
The key word is Distributed Denial of Service.
Feb
14
comment “Yea, I can hear them” I just heard this from my computer speakers
Remote access trojan...
Feb
11
comment What level of anonymity can I expect while using a library's user session?
Freedom of the press belongs to them what owns their own press.
Feb
8
comment Default Encryption - A Panacea or Placebo
Default encryption will shift the attack points. We already see that in action.
Feb
8
comment Why use one URL for all “pages” on my site?
What is the "logic" behind C and breaking the http status codes the web server sends out?
Feb
4
comment find if 0-day flash bug was exploited (on a particular machine)
Allowing User Level compromise is pretty late in the game and an underestimation. You don't have to catch a rootkit to be owned at the user level and to have leaked everything. Google applications that install in userland are a pretty good demonstration that a lot less than nothing gets installed ;^).
Jan
20
awarded  Nice Answer
Jan
20
revised An attacker has my IP address;So what?
added paragraph that explains response as answer to question.
Jan
20
answered An attacker has my IP address;So what?
Jan
18
comment Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?
@SteffenUllrich - Pretty much the grain of truth at the heart of it, as long as humans have to interact with encryption, there's always an end run around it.
Jan
6
comment How can Stripe be PCI-compliant?
Newer methods use tokenization tied to your website. The credit card details get validated and stored on the processor's PCI compliant servers (less CVV) and a token tied to the web merchant's server is all that's stored on the website.
Jan
1
comment How to make Reaver crack WPS faster
You're brute-forcing, more and faster processing power? Write your own GPU based Reaver?
Dec
25
comment My internet fingerprint
As with anyone who's experienced identity theft (similar process), it is a full time job and basically, if it really means that much to you, you bite the bullet and start the process for what can be changed and deal with the rest. Get offline, move elsewhere and legally change your real life identity is the most severe tactic.
Dec
25
comment my table is dropped in PDO
bobby drop tables