10,946 reputation
63697
bio website security.stackexchange.com
location Florida
age 31
visits member for 3 years, 3 months
seen 3 hours ago

I'm not the droid you're looking for.


Apr
14
awarded  Notable Question
Apr
14
awarded  Reviewer
Apr
14
reviewed Close Are there “secure” languages?
Apr
14
reviewed Close Hiding Membership Provider from other developers
Apr
14
reviewed Reject suggested edit on What should I know before configuring Perfect Forward Secrecy?
Apr
11
reviewed Close Google ads and/or DoubleClick wants to access the keyboard API in Firefox?
Apr
11
reviewed Close How do I enable EVP functions in openssl?
Apr
10
revised heartbleed wiki excerpt
added 42 characters in body
Apr
10
suggested suggested edit on heartbleed tag wiki excerpt
Apr
10
comment Can an external tool accurately determine the current vulnerability of a site to Heartbleed? How? Was vulnerability remediated?
@BillR security.stackexchange.com/questions/55083/…
Apr
10
awarded  Notable Question
Apr
9
awarded  Nice Answer
Apr
9
answered Should I change all my passwords due to heartbleed
Apr
9
reviewed Close Does heartbleed have any effect if OpenSSL was only used to generate the certificate
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
@RubberDuck See here: explainxkcd.com/wiki/index.php/Category:Characters for a list of XKCD characters.
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
As you've said in your self-answer, it is not likely that Heartbleed can read memory from outside of the web server's own process. However, the important thing to bear in mind is that everything Megan enumerates in her first three lines may indeed be in that process' allocated memory space. Literally anything the website sends to or receives from its users is at risk, as well as some supporting data (e.g.: the private keys) required for the web server's operation.
Apr
8
comment HeartBleed - How to detect compromised websites
Note that changing your password on the site is only really valuable after the site has been patched so that it is no longer vulnerable.
Apr
8
comment HeartBleed - How to detect compromised websites
There are ways to determine whether a site is currently vulnerable, but what makes this issue so critical is that sites which are not currently vulnerable (but were in the past) may have been exploited before. There's no way for system administrators to know if their site has been previously exploited, and there is no way for users to tell if there's a MitM who's exploited a site because the attacker would be using the legitimate original certificates.
Apr
4
comment How many possible combinations in 8 character password?
@Adnan That's the number of possible passwords without restrictions on any of the characters - not what's being looked for here.
Apr
4
comment How many possible combinations in 8 character password?
This might be useful: math.stackexchange.com/q/497257