1,205 reputation
1923
bio website
location
age
visits member for 2 years, 11 months
seen Aug 25 at 7:12

Apr
8
comment Is leaking the hash of your encryption key a security risk?
@JohnLeidegren is it possible to have the sender know the recipients public key ahead of time? Then the sender can simply make up a key and encrypt it using the receiver's public key. This would allow you to use RSA or another established asymmetric encryption scheme rather than reinventing one.
Mar
23
comment Why are GPUs so good at cracking passwords?
Some context on the numbers: assuming a set of about 100 possible characters, there are 1 trillion possible 6-digit passwords. At a billion passwords per second, this is a bit under 17 minutes to try every possible 6-digit password. Less if we assume the character set is smaller (most people will never use a good chunk of the printable ASCII character set in passwords). Another reminder to salt your hashes.
Mar
22
awarded  Popular Question
Mar
10
comment Should I change the default SSH port on linux servers?
Note that running SSH on a port over 1024 (i.e. a non-priveleged port) is actually potentially a security vulnerability. Only root can bind to privileged ports (<1024), so you can know that services running here are at least started by root. Let's say you run SSH on port 2222 and your sshd crashes for some reason. Now any local user can start their own (fake) sshd on port 2222 which might do bad things like stealing your password!
Feb
18
comment Hiding JavaScript source code
@Celeritas if your company makes a cool web app with lots of clientside JavaScript, they probably want to prevent other companies from making a clone of their web app and stealing their customers. By obfuscating the code, which anybody can see, you make it harder to make a copy of the code, since it's purposefully made difficult to understand by a human. You can still make a copy of the obfuscated code, but normally you will want to modify it (e.g. to work with your server), and that's harder. Obfuscating code has little to do with security and lots to do with protecting property.
Feb
17
comment Hiding JavaScript source code
There's little reason to even attempt to hide the code used for basic web page use. The primary reason people obfuscate code is because they don't want others to be able to copy that code. By obfuscating the code, they make it harder (not impossible, and not very hard) for somebody to copy their code and use it on their own site. It's not a security thing.
Feb
17
comment Is there a difference between GET and POST for web application security?
@HendrikBrummermann I think they are considerably more difficult to execute in many cases. I can make you submit a GET request wherever I want with an <img> tag on any page you load. Lots of sites let you embed images from external hosts, including this one, meaning I don't even have to convince you to go to my website. Not so many let you embed arbitrary JavaScript.
Jan
31
comment How do you get a specific .onion address for your hidden service?
These names are generated in almost the same way that novelty tripcodes are generated on image boards like 4chan.
Jan
28
accepted What are darknets, and how can they be used to provide security and anonymity in network communication?
Jan
26
comment Is an ATM alert system triggered by typing the PIN in reverse a secure solution?
"I never use the duress PIN so I forgot it." Most ATM robbers aren't going to shoot somebody because they forgot their PIN, especially if they've provided at least one PIN.
Jan
26
comment Should sensitive data ever be passed in the query string?
agreed, just wanted to throw that out there for anybody else reading.
Jan
25
comment How to find a reliable private mail drop or ghost address provider? (Not CMRA)
I might have misunderstood the OP, but I think s/he was asking about physical mail (not email). In other words, he wants to give a proxy address every time he orders something online, and have all packages/mail sent to that proxy address forwarded to his real address (which only the proxy service knows).
Jan
25
comment Should sensitive data ever be passed in the query string?
Re: the SO question you linked to: yes, the URL is encrypted, but a man-in-the-middle can often still tell what website you are visiting based on the IP (and other metrics, such as amount of data transferred). If you have SNI enabled (your browser probably does), the domain is actually sent in plain text before upgrading to SSL.
Jan
25
awarded  Nice Question
Jan
25
awarded  Nice Answer
Jan
21
comment Is suspicious network activity likely to be caused by a rootkit?
Alternatively, if you can flash your router with DD-WRT (or similar), you can SSH in and monitor your network with tcpdump.
Jan
21
comment Is TLS secure when full eavesdropping on the network occurs?
@Brett see the question Giles linked.
Jan
21
comment Can my ISP know my passwords
I should add that if you don't trust your government, you probably shouldn't trust the PKI (your government probably runs a root CA or can compel a root CA to sign a fake cert).
Jan
20
awarded  Self-Learner
Jan
20
comment Privacy in torrents?
Not only is torrenting over Tor impractical in the first place, but many Tor exit nodes use traffic shaping to block BitTorrent traffic. The Tor model isn't suited to high bandwidth traffic.