meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 4 months |
| seen | 14 hours ago | |
| stats | profile views | 27 |
|
1d |
awarded | Announcer |
|
Apr 8 |
comment |
Is leaking the hash of your encryption key a security risk? @JohnLeidegren is it possible to have the sender know the recipients public key ahead of time? Then the sender can simply make up a key and encrypt it using the receiver's public key. This would allow you to use RSA or another established asymmetric encryption scheme rather than reinventing one. |
|
Mar 23 |
comment |
Why are GPUs so good at cracking passwords? Some context on the numbers: assuming a set of about 100 possible characters, there are 1 trillion possible 6-digit passwords. At a billion passwords per second, this is a bit under 17 minutes to try every possible 6-digit password. Less if we assume the character set is smaller (most people will never use a good chunk of the printable ASCII character set in passwords). Another reminder to salt your hashes. |
|
Mar 22 |
awarded | Popular Question |
|
Mar 10 |
comment |
Should I change the default SSH port on linux servers? Note that running SSH on a port over 1024 (i.e. a non-priveleged port) is actually potentially a security vulnerability. Only root can bind to privileged ports (<1024), so you can know that services running here are at least started by root. Let's say you run SSH on port 2222 and your sshd crashes for some reason. Now any local user can start their own (fake) sshd on port 2222 which might do bad things like stealing your password! |
|
Feb 18 |
comment |
Hiding JavaScript source code @Celeritas if your company makes a cool web app with lots of clientside JavaScript, they probably want to prevent other companies from making a clone of their web app and stealing their customers. By obfuscating the code, which anybody can see, you make it harder to make a copy of the code, since it's purposefully made difficult to understand by a human. You can still make a copy of the obfuscated code, but normally you will want to modify it (e.g. to work with your server), and that's harder. Obfuscating code has little to do with security and lots to do with protecting property. |
|
Feb 17 |
comment |
Hiding JavaScript source code There's little reason to even attempt to hide the code used for basic web page use. The primary reason people obfuscate code is because they don't want others to be able to copy that code. By obfuscating the code, they make it harder (not impossible, and not very hard) for somebody to copy their code and use it on their own site. It's not a security thing. |
|
Feb 17 |
comment |
Is there a difference between GET and POST for web application security? @HendrikBrummermann I think they are considerably more difficult to execute in many cases. I can make you submit a GET request wherever I want with an <img> tag on any page you load. Lots of sites let you embed images from external hosts, including this one, meaning I don't even have to convince you to go to my website. Not so many let you embed arbitrary JavaScript. |
|
Jan 31 |
comment |
How do you get a specific .onion address for your hidden service? These names are generated in almost the same way that novelty tripcodes are generated on image boards like 4chan. |
|
Jan 28 |
accepted | What are darknets, and how can they be used to provide security and anonymity in network communication? |
|
Jan 26 |
comment |
Is an ATM alert system triggered by typing the PIN in reverse a secure solution? "I never use the duress PIN so I forgot it." Most ATM robbers aren't going to shoot somebody because they forgot their PIN, especially if they've provided at least one PIN. |
|
Jan 26 |
comment |
Should sensitive data ever be passed in the query string? agreed, just wanted to throw that out there for anybody else reading. |
|
Jan 25 |
comment |
How to find a reliable private mail drop or ghost address provider? (Not CMRA) I might have misunderstood the OP, but I think s/he was asking about physical mail (not email). In other words, he wants to give a proxy address every time he orders something online, and have all packages/mail sent to that proxy address forwarded to his real address (which only the proxy service knows). |
|
Jan 25 |
comment |
Should sensitive data ever be passed in the query string? Re: the SO question you linked to: yes, the URL is encrypted, but a man-in-the-middle can often still tell what website you are visiting based on the IP (and other metrics, such as amount of data transferred). If you have SNI enabled (your browser probably does), the domain is actually sent in plain text before upgrading to SSL. |
|
Jan 25 |
awarded | Nice Question |
|
Jan 25 |
awarded | Nice Answer |
|
Jan 21 |
comment |
Rootkits, how much should I be concerned? I found a suspicious activity on my network Alternatively, if you can flash your router with DD-WRT (or similar), you can SSH in and monitor your network with tcpdump. |
|
Jan 21 |
comment |
Is TLS secure when full eavesdropping on the network occurs? @Brett see the question Giles linked. |
|
Jan 21 |
comment |
Can my ISP know my passwords I should add that if you don't trust your government, you probably shouldn't trust the PKI (your government probably runs a root CA or can compel a root CA to sign a fake cert). |
|
Jan 20 |
awarded | Self-Learner |
