11,997 reputation
744109
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 9 months
seen yesterday

I'm not the droid you're looking for.


Oct
16
awarded  Popular Question
Oct
16
reviewed Close Mentioned On A Blog By A “Hacker” - Should I Care?
Oct
16
reviewed Close How does email routing work?
Oct
10
awarded  Popular Question
Oct
8
reviewed Close Can 2 devices have same host-name on same network?
Oct
7
comment A low tech yet secure way to keep track of passwords?
@yzT Yes, but when one leaves/transfers that's 300 passwords you need to change.
Oct
6
comment A low tech yet secure way to keep track of passwords?
@yzT Not sure I'd really recommend that, depending on what the passwords are for. Keep in mind that any employee with read access probably can just copy the KeePass database and walk out the door with those passwords. You could change the key for the database on your server, but that won't affect their copy - you'd have to change all 300 passwords.
Oct
6
revised A low tech yet secure way to keep track of passwords?
added 61 characters in body
Oct
6
awarded  Nice Answer
Oct
5
awarded  Nice Question
Oct
1
reviewed Close How can we represent SSL and Firewall in OSI Model?
Oct
1
comment How can we represent SSL and Firewall in OSI Model?
Many advanced networking components span several (and, in some cases, all) of the OSI layers. The OSI model is just a general guide for you to use for troubleshooting and problem analysis. Is there a particular problem you're trying to solve by figuring out which layers your devices/applications affect?
Oct
1
revised What operating systems and devices are known to be affected by Shellshock? What patches are available?
added 21 characters in body
Oct
1
revised What operating systems and devices are known to be affected by Shellshock? What patches are available?
added 21 characters in body
Oct
1
revised What operating systems and devices are known to be affected by Shellshock? What patches are available?
added 647 characters in body
Oct
1
revised What operating systems and devices are known to be affected by Shellshock? What patches are available?
added 647 characters in body
Oct
1
revised What operating systems and devices are known to be affected by Shellshock? What patches are available?
added 253 characters in body
Sep
30
awarded  Explainer
Sep
30
comment Passwords in plaintext?
@marcomanzoni Different apps and OS's handle invalid certificates differently. Most desktop web browsers and Operating Systems are pretty good about warning the user of invalid certificates. Other desktop applications may not be so reliable. Mobile platforms, especially at the app level, are hit or miss. When an app fails to warn a user that a server it is contacting has presented an untrustworthy certificate (i.e.: one not signed by a CA the app or device has been configured to trust), that represents a vulnerability in the app.
Sep
30
comment Passwords in plaintext?
Sounds to me like @marcomanzoni isn't very familiar with SSL proxies, and therefore possibly hasn't configured their phone with the BurpSuite CA. Given that, one of two things has probably happened: 1.) User ignored SSL warnings provided by the app. 2.) App ignored untrustworthy SSL certificate and proceeded without presenting warning or error. The former is a common end-user issue. The latter is a security vulnerability in the app.