meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 1 month |
| seen | Apr 8 at 23:40 | |
| stats | profile views | 4 |
|
Apr 4 |
comment |
Are secret URLs secure over HTTPS? Do any known browsers send HTTPS URLs to third parties, ever? For example, Firefox crash reporter, or Chrome search-as-you-type, or IE's malware protection service? |
|
Apr 4 |
comment |
Are secret URLs secure over HTTPS? @Timwi nor is there anything in the HTTPS protocol preventing Chrome hosting a remote desktop server and uploading all your passwords to a third party; that's not the point :) |
|
Apr 4 |
comment |
Are secret URLs secure over HTTPS? Related: Can URLs be sniffed when using SSL - but different; that question is about the data contained in the request, not whether the browser leaks it through other channels. |
|
Mar 18 |
comment |
What are the security implications of people downloading addons, wrongly thinking that they are safe? @Piskvor Yeah, those UAE prompts totally train users to ignore them. Where's the "I trust this particular program; don't warn me again unless it changes" button?... |
|
Jul 5 |
comment |
Is this phishing or the real PayPal? I've also seen paypal.com redirect me to paypal-business.co.uk, which gave me quite a shock a few times. It's like they're trying to look like a fake... |
|
Jul 3 |
comment |
Establish a secure channel with mutual authentication given pre-shared public keys I was hoping that since Diffie-Hellman with pre-shared public keys is mentioned in at least one source, it's at least somewhat analyzed by experts, or maybe even implemented... |
|
Jun 28 |
comment |
What prevents people getting charged over NFC in crowded places? @SomethingSmithe It wouldn't be unlike banks to do this just for the show, whereby there's no real cryptography going on. (where the bank could verify that the user actually provided the pin to the reader). |
|
Jun 18 |
comment |
Are there any nice info sites dedicated to explaining how and why to (not) store user passwords in the database? I especially like the first one. |
|
Mar 27 |
comment |
What can I do if my bank thinks my date of birth is “known only to me”? @LucasKauffman Before I name one, I guess I should double-check that they would actually execute a money transfer over the phone with just DoB + postcode. They give out the balance and cancel cards with just this much, but that’s not as sensitive as withdrawals. |
|
Mar 26 |
comment |
What can I do if my bank thinks my date of birth is “known only to me”? I doubt that enough people will do it though; this requires someone with a huge social network and a lot of influence to do a move like that. Or someone with enough money to take out that the bank actually gives a damn... at least a few million, I reckon. |
|
Mar 26 |
comment |
What can I do if my bank thinks my date of birth is “known only to me”? @GeorgeBailey They’re replacing the 3D Secure system, which, in case you aren’t from a country that uses such a thing, is basically something that asks you for a password before authorizing an online card payment. This was already known to be very insecure (pdf) so the change isn’t that significant. Separately from that, my bank has always allowed me to "log in" over the phone with nothing but account number, date of birth and/or postcode. |
