588 reputation
214
bio website
location
age
visits member for 3 years, 5 months
seen 9 hours ago

Jun
22
comment Can I detect a MITM attack?
I proven Perspective unusable here: security.stackexchange.com/questions/12081/…
Mar
10
comment What are the security implications of “Row Hammer” attack?
"A system could ensure that, within a given refresh period, it does not activate any given row too many times without also ensuring that neighbouring rows are refreshed?" From your own link... For us mortals this just means change RAM on critical servers/network
Mar
10
comment Why do phones have SIM cards?
@moose: I guess I did not express myself clearly enough. I know what you mean, there are a few issues to solve going that way. My point was, if you really want to get rid of the sim card concept (not only the hardwaore), you're going to have to solve a whole other bunch of problems. I wanted to counter OP who implied we could simply get rid of this as it is a remnant of the past. My point was that he just wanted a simplified where the SIM data would be moved not solely to a remote server but also to persistent storage, thus proving pointless and creating more problems and limitations.
Mar
9
comment Why do phones have SIM cards?
@moose: Then how do you save the set up ? If you reguard sim as persistant storage with initialization data on it, then you realize it is the everywhere as the minimal information needed to make the connection that will help you retrieve your account data and allow you to use the network. If you remove that sim, you still have to move the data to storage, which makes a sim free phone in it's implementation but not in concept. Then changing user/operator would mean flashing/replacing your storage. Easier with low coupling and dedicated replaceable device, right?
Feb
23
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
And adding to that, defense level actors are working together with such firms of course, access to foreign technologies to empower local companies is a day-to-day activity for the spying business. I want to stress that nothing changed, Chinese companies put malware as Cisco and other companies add backdoor and channel out data to others. It is the same, it is a matter of trust and strategy, do not overreact and work on your company strategy would be the best.
Feb
23
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
@RŠ¾ryMcCune: Sorry my English is not that great, I did not mean to suggest defense level companies would be a threat. More to compare how they defend against those threat because there is a high value to doing so. For companies, you can try to go as far as them, until the cost/benefit ratio exceeds your budget and strategy. >What are the security risks of having OEMs or other companies installing this kind of software onto customers systems? The risk has always been present in the mind of security professionals, vendors identified as non-secure will be avoided, as always.
Feb
20
comment Why do phones have SIM cards?
Basically you propose to always have a sim in the phone when you buy it (if you think about it, you can think of such phones as sim free). It exists. To remove the sim card means to still have the data in the phone, it's just a flat design easier to maintain and diagnose for operators/phone manufacturers.
Feb
20
comment Certificate advice for deploying code-signed software as a 3rd party vendor
You can just put it in the agreement signed by both parties an obligation to protect the certificate. You could have one especially for this project and only give it to the dev company? So if it leaks, you can point your finger at them. Definitely sign your applications, but most importantly teach users to only download it from a trusted source. Also, regular audits should also focus on checking sensitive applications are legits (cksum...)
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
Defense level companies control the whole manufacturing chains. This kind of attacks are not new. For organizations, it might make sense to select vendors based on their reputation. This kind of news about Lenovo and others should definitely influence the market at some level. It does not mean your grandmother needs a Chinese-only laptop (assuming you are Chinese).
Jan
5
comment Firefox Flash plugin malware?
@sourcejedi: I disagree because I repeat it, chrome does not support NoScript and browsing without no script is just screaming to get hacked. Of course flash is an issue, and it will always be.
Oct
2
comment version support policy for BYOD devices
2 Wifi spots: 1 for leasure/personnal. The other for work. For the first, where the Android/iOS devices come in I think you just should let it go. The other one, it's another issue entirely to me.
Oct
2
comment Why injecting a php tag with XSS dosn't work?
XSS = interpreted on client side. Clients don't deal/understand PHP. To inject dynamic PHP would be possible in very very very specific contexts and XSS are completely unrelated to this
Jul
9
comment Is “Why Should You Avoid AES In MySQL?” true?
This ^. Although I think that there are a lot of issues with encryption as it might open the gate to amplification attacks. Thus using a secure layer as SSL might do it... But again, SSL cannot be really trusted. Anyhow, a captured encrypted password or a captured password is about as dangerous if you can just replay it
Jun
30
comment Is CSRF possible if I don't even use cookies?
This is the correct way to do it, check how django does it: docs.djangoproject.com/en/dev/ref/contrib/csrf. It's basically a randomly generated and unique CSRF token that's on the page you visit. If the server doesn't receive it then it will not process the request at all.
Apr
28
comment Localhost WebSocket defense
Can't edit anymore, but I obviously meant EC not EC2. As in the dual elliptic curve algorithm that is compromised (or actually broken by design). Which is funny since the NSA recommends (nsa.gov/business/programs/elliptic_curve.shtml) using it. While there are no proof they got the magic numbers needed to break the algorithm, but they do encourage its use even though there's a "backdoor" built-in.
Apr
28
comment Why does a business need to secure its email system?
How about "What are the different email securing strategies available for businesses?", it should be pretty obvious that email needs securing, I hope that's not the whole point of your research
Apr
28
comment Why does a business need to secure its email system?
What's the research about specifically? We can give you better answers if you give us more background and tell us what exactly you are researching
Apr
28
comment Why does a business need to secure its email system?
IMHO it's obviously homework. For the sake of argument let's remind people that securing an email system is not subject to debate. Also, notice OP's nickname.
Feb
27
comment Yahoo Account hacked, changed pw, spam still going out elsewhere?
Sometimes emails can take a while to be rejected. Just wait, if it keeps happening you should investigate the IP and headers to see if they match Yahoo SMTP settings (send an email to a fake address and wait for the rejected reply to compare). Worst scenario he has a session open (cookie hax) and will use it until it expires (in an automated fashion ofc). Best case, no SPF for yahoo and he sends the emails on your behalf from somewhere else, to check this, edit your Name (From: "Rob TheReal Lastname") and check if it appears in future rejected reports
Jan
13
comment Localhost WebSocket defense
@Gracchus: It could. In IT security you should always assume the worst case scenario, which is basically why we implement strong solutions using the Plan, Do, Check method. If malicious code runs on a virtual machine with the least privileges it could still break out of the VM and get control of your host for instance (seen it the wild). Against cryptography there are some attacks, it's important to know which algorithm is broken and which is not, in the case of SSL, check out SSL VS TLS and their different versions/vulnerabilities. And stay away from EC2.