11,697 reputation
743103
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 6 months
seen 2 days ago

I'm not the droid you're looking for.


2d
comment Can sites which check your password as you type pose a security risk?
@sapi Oh, sorry. I misread. Are you certain it's actually checking for correct username/password pair? Have you tried typing a wrong password which otherwise meets the site's complexity requirements? For example, try adding another character to your password at the end or changing one of the characters in your password to a different character of the same type (e.g.: if it's a lowercase letter, change to a different lowercase letter). Does it still give you a check-mark then? What about the right password but wrong (but correctly formatted) username?
2d
comment Can sites which check your password as you type pose a security risk?
Additionally, checking the password as you type is not demonstrative of the site storing it in the clear or with encryption instead of hashing. It's much more probable that the site is not storing it at all (only retaining it in memory long enough to check it and provide a response - and even then, again, this is probably done client-side so the server doesn't even have it in the first place) until you submit the form. Then, if they're responsible, it's most likely salted and hashed properly. Why are you assuming the unlikely case that this is not done client-side again?
2d
comment Can sites which check your password as you type pose a security risk?
I highly doubt that these sites are checking your password as you type server-side. Aside from being a security risk in and of itself, it means much more network and system overhead for the server. It's most likely that the password is being checked via a client-side script. In either case, the cleartext password is probably discarded after the check result is provided to the user and/or after form submission. So the only attack you would have to worry about is capture in transmission, which should be encrypted via SSL and (if the check is client-side) not happening anyway.
Jul
23
comment Open list of adult websites for child internet
Trying to block [all things of categories x,y,z,...] on the Internet is, for all practical purposes, impossible with blacklisting. If you really want to restrict your child's view of the Internet, you should use whitelisting (permitting traffic only to select approved sites/services). However, this quickly becomes a management overhead nightmare as they grow older and have legitimate educational and developmental needs to broaden their view of the Internet. Besides, they'll just end up browsing whatever you don't want them to see on their phone anyway.
Jul
22
reviewed Close Edit/Remove Timestamps for files and file system
Jul
21
reviewed Reviewed Tools to make a security researchers life easier - tracking vulnerability research
Jul
21
answered Do non-browser clients work around Gmail's 2-factor authentication?
Jul
18
answered Hacking own computer
Jul
17
reviewed Close How safe is virtual box without internet
Jul
14
revised PGP/GPG verifying authenticity
added 135 characters in body
Jul
14
comment Is it possible to track a missing brand new phone?
I'm kind-of on the fence, here. The question really does present itself as an XY Problem. However, even though the proper solution to our "problem X" is out-of-scope for this site, a question about the "solution Y" could still have value.
Jul
14
comment Can I get a public key from PGP signature?
Also note the WARNING starting on the fourth-from-last line. While you can get the public key information, it's of limited value unless you can also confirm the key itself is trustworthy.
Jul
14
comment Can I get a public key from PGP signature?
Bear in mind that, while it may be possible to get the public key, you should still also verify the key itself (e.g. verify trusted third-party signatures on the key, or contact the owner out-of-band) before trusting the signature.
Jul
14
revised This JavaScript code is injected on my hotel Wi-Fi: should I be worried?
added 3 characters in body
Jul
11
awarded  Announcer
Jul
11
awarded  Nice Question
Jul
10
comment How did my network admin identify my iPhone and how can I hide my ID?
"How to stay unnoticed in a professional network" really needs just three words: "Stay off it." Note that this is an all-inclusive statement, covering wireless, wired, or any other connection. If you're on a managed network, and doing things the network admins don't like, they can find you. This is especially applicable if "things you're doing that the network admins don't like" includes "hogging all the bandwidth".
Jul
10
asked Is an Antivirus scan via network share equivalent to an offline scan of the system?
Jul
10
reviewed Close Software for web hacking?
Jul
10
reviewed Close What are some considerations before moving personal data to Google Drive?