550 reputation
214
bio website
location
age
visits member for 2 years, 5 months
seen Jul 17 at 12:15

Jul
9
comment Is “Why Should You Avoid AES In MySQL?” true?
This ^. Although I think that there are a lot of issues with encryption as it might open the gate to amplification attacks. Thus using a secure layer as SSL might do it... But again, SSL cannot be really trusted. Anyhow, a captured encrypted password or a captured password is about as dangerous if you can just replay it
Jun
30
comment Is CSRF possible if I don't even use cookies?
This is the correct way to do it, check how django does it: docs.djangoproject.com/en/dev/ref/contrib/csrf. It's basically a randomly generated and unique CSRF token that's on the page you visit. If the server doesn't receive it then it will not process the request at all.
Apr
28
comment Localhost WebSocket defense
Can't edit anymore, but I obviously meant EC not EC2. As in the dual elliptic curve algorithm that is compromised (or actually broken by design). Which is funny since the NSA recommends (nsa.gov/business/programs/elliptic_curve.shtml) using it. While there are no proof they got the magic numbers needed to break the algorithm, but they do encourage its use even though there's a "backdoor" built-in.
Apr
28
comment Why does a business need to secure its email system?
How about "What are the different email securing strategies available for businesses?", it should be pretty obvious that email needs securing, I hope that's not the whole point of your research
Apr
28
comment Why does a business need to secure its email system?
What's the research about specifically? We can give you better answers if you give us more background and tell us what exactly you are researching
Apr
28
comment Why does a business need to secure its email system?
IMHO it's obviously homework. For the sake of argument let's remind people that securing an email system is not subject to debate. Also, notice OP's nickname.
Feb
27
comment Yahoo Account hacked, changed pw, spam still going out elsewhere?
Sometimes emails can take a while to be rejected. Just wait, if it keeps happening you should investigate the IP and headers to see if they match Yahoo SMTP settings (send an email to a fake address and wait for the rejected reply to compare). Worst scenario he has a session open (cookie hax) and will use it until it expires (in an automated fashion ofc). Best case, no SPF for yahoo and he sends the emails on your behalf from somewhere else, to check this, edit your Name (From: "Rob TheReal Lastname") and check if it appears in future rejected reports
Jan
13
comment Localhost WebSocket defense
@Gracchus: It could. In IT security you should always assume the worst case scenario, which is basically why we implement strong solutions using the Plan, Do, Check method. If malicious code runs on a virtual machine with the least privileges it could still break out of the VM and get control of your host for instance (seen it the wild). Against cryptography there are some attacks, it's important to know which algorithm is broken and which is not, in the case of SSL, check out SSL VS TLS and their different versions/vulnerabilities. And stay away from EC2.
Jun
26
comment Why use OpenID Connect instead of plain OAuth?
@Ralf: As I see it, you can build apps with oauth and authorize sharing or not of specific resources linked to the user account. Using openid connect, it is made easier, the provider doesn't have to implement its own layer above oauth to handle it and clients have a standard way to access data.
Jun
21
comment Why use OpenID Connect instead of plain OAuth?
Alright, I didn't know about "OpenID Connect", I understood it as "OpenID" + "Connect". I'm sure you've already checked this: softwareforallseasons.blogspot.fr/2011/10/… + I suggest you edit your question so that it reads OAuth 2.0 instead of just OAuth.
Jun
21
comment Why use OpenID Connect instead of plain OAuth?
It's more than an authentication mechanism, OAuth will enable your application to retrieve shared contents and ask for the permission to do so. For example: facebook/gmail apps, you click agree to share your contacts and let the app write on your wall. The app then gets a token that gives it the permission to do so. If you are doing only authentication and will not do more, you could stick to openid. Note that OpenID is not that friendly compared to OAuth. I would use openid for geek/techie things and oauth for social apps.
Mar
21
comment Is it possible to execute a php script in an image file?
How do you display the image? The extension .gif at least reduces the possibility of code execution. If you use require() and not standard HTML then it's dangerous, else David Mah is right.
Mar
21
comment Is it possible to execute a php script in an image file?
Please tell us what check you already perform on the file. Do you check the extension at least? Some answers make assumptions on that.
Feb
22
comment How to proceed if a new hash algorithm for passwords is introduced?
@CodesInChaos: Changing the hash algorithm is done for a reason. Else the change can occur over time as users will need to change their passwords. It's worth pointing out that if the old hashes were leaked this solution wouldn't be useful. It's useful if you want to answer the need of changing the hash algorithm transparently, as a user I like it, but as an admin, I see no added value. Sure, now the hashes are harder to break, but that's only one of the thing we wanted to avoid with this decision.
Jun
5
comment Configure Linux to allow network activity based on binary?
@curiousguy: I think people need an antivirus/malware/etc for this feature, and they should leave packet filtering to packet filters (known as firewall). You can accept/deny/drop connections without touching the packet filter. It will come on Linux since it's becoming very popular, but really not yet
May
31
comment Configure Linux to allow network activity based on binary?
@curiousguy: Hum, it's too long to demonstrate and explain thoroughly, some pointers: a program name can be changed, a firewall is a packet filter, packets are going though the network cards and pass a filter before being processed, this is what a firewall does. As a matter of fact no, I am careful, but others aren't and need this feature. Linux is a kernel, it just takes care of hardware basically, an OS is more than that, it's all the programs that run: WM, DE, web browser, shell, etc. Different people work on these, the kernel is a whole world apart which just provides interfaces.
May
31
comment Physical machines not detected from a Backtrack VM
Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting.
May
31
comment Configure Linux to allow network activity based on binary?
BTW, I'd guess that windows implement this as a antivirus, by placing hooks on network library functions. Which with some level of reverse engineering, can be bypassed. There are many ways to bypass it, it's not a cutting edge security feature at all, it's here to cut down malware infection which is very important on windows. Maybe it'll change in your favorite distribution over time, but for now, it's not a good idea.
May
31
comment Configure Linux to allow network activity based on binary?
@curiousguy: A firewall is just a packet filter, it only pays attention to network traffic, and not to application running. Moreover, firewalls are not usually workstations, but dedicated machines who filter traffic, you don't run any program you don't know/trust on it like you'd do on a workstation. Userland is separated from the kernel, "The Linux kernel is developed and maintained separately from userland." en.wikibooks.org/wiki/Guide_to_Unix/Linux#Kernel This is true for all UNIX-like systems.
May
31
comment Configure Linux to allow network activity based on binary?
@Jez: Because you don't want to calculate the checksum manually for each binary (especially if you upgrade them often as you usually do on linux). Without this, cp malware /tmp/firefox will bypass your security.