Reputation
1,273
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
8 10
Newest
 Yearling
Impact
~53k people reached

Feb
4
comment Will typing my password twice make it more secure? Or typing each character twice?
@no comprende: And then you come home drunk and your dog doesn't recognize you (because you smell funny, and speak funny, and walk funny, and act funny; as far as the dog is concerned, you ARE NOT "you." BTW this scenario actually happens quite often IRL). And it gets plenty mad. What exactly did you train the dog to do to intruders? Oops. (In other words, your scenario is built on the invalid premise "false negatives never happen.")
Feb
4
comment Why attack detection based on the same user request from different places (e.g. by IP) is not widely used?
Anecdotal rebuttal against "but what if the user never switches networks, why would they ever get a different IP address" is "mobile:" on a 3 hr train ride, I've been using a single device from the same 3G network, without any VPNs or roaming. Yet, without any intervention on my part (and without me even noticing - found out ex-post from my logs), I have been assigned about 4 different IP addresses from what looks like different IP pools; apparently the mobile carrier assigns them somewhat geographically - and well, my location did change a lot. Suspicious behavior? Probably not.
Jan
26
comment Why would a website want to know what operating system you are using?
@My1: UserAgent header is a tragic piece of history, and getting any sort of useful data out is a pain. Using JS is significantly simpler.
Jan
25
comment Could I recover the content of file from its checksum/hash?
@Mehrdad: Or the people running Powerball, for that matter.
Jan
21
comment How can systems recognize different wifi AP with the same SSID and MAC address
@Requiel: To a client, if the SSID and security params are identical, there is only one network and the client will roam across the APs back and forth, based on link performance (which is not necessarily "strongest signal" and seems to be implementation-dependent). That's not a bug, that's a feature. I suspect that splitting this into two networks would require significant changes in client's association and roaming code.
Dec
30
awarded  Yearling
Dec
8
comment How can a intercepting tool(Burp) breaks the SSL connection between a browser and the server even if the application employes HTTPS
Perhaps it's not going through Burp? Or uses some different encryption system instead of HTTPS?
Dec
4
comment How can a intercepting tool(Burp) breaks the SSL connection between a browser and the server even if the application employes HTTPS
Did you add Burp's CA to your browser? In that case, you gave it the authority to re-encrypt the SSL conversation using its own toolset. The connection is not broken: the chain of trust is compromised (by user action). See: portswigger.net/burp/help/proxy_options_installingCAcert.html
Aug
31
comment Is a password in the clipboard vulnerable to attacks?
@Jonathan Garber: Not all - some of them emulate keystrokes, and in this mode the password does not touch the clipboard at all.
Mar
27
awarded  Nice Answer
Mar
27
answered Can 'cracked' product keys harm the user in any way?
Jan
28
answered Do webcams generates logs on operating system?
Jan
21
comment Apps that require user to install advertised apps in order to get activated
I would say "misleading in its description," as it apparently fails to mention this requirement.
Dec
30
awarded  Yearling
Aug
14
comment Is it possible for a phone to be transmitting even while turned off and the battery removed?
If there's another battery (or a supercapacitor, or whatever), it's possible to remove the first battery, but then the question becomes "with two batteries, can they be hot-swapped?", which is quite a different question ;) So - no, without a source of power, it is not possible to draw power necessary for functioning, certainly not longer than a few seconds. Now, the real question appears to be "is it possible to hide another battery inside the device?"
May
9
comment Why is php not used for banking sites or for a banking transaction?
@user24408: Speed doesn't come into the equation here - with all the options PHP now has, it's as good as compiled (HHVM); for most ops, the system will be database-bound or io-bound anyway. I posit the maintenance cost is the actual issue, not actual performance.
Mar
27
comment QR codes that can't be copied - possible?
My hand-held device uses natural light. It also contains, besides the QR-code app, a Camera app (incidentally, most devices also access the same software stack for camera and QR scanning) - voila, I have overcome this barrier by making a photo, using the same smartphone I might use for scanning (and many QR apps can work on any image - so now I'm able to QR-scan this image anywhere, anytime).
Mar
26
comment How are shopkeepers getting the MAC address of wifi enabled smartphones?
@spartan: See security.stackexchange.com/a/54068/884
Mar
25
suggested rejected edit on Why does Evil twin works?
Feb
24
comment Is BitTorrent Sync a spyware?
Note that measuring data volume is not the same thing as having access to it: with correctly used strong crypto, a third party could still see that 20 GB are stored, but won't have a clue what the data is.