12,271 reputation
745110
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 10 months
seen 9 hours ago

I'm not the droid you're looking for.


16h
comment Continued Use of Kerberos
@SamuelJudson Did you just comment, or flag it for moderator attention? The latter will usually get you migrated if it's a good question and migration is appropriate.
17h
comment Continued Use of Kerberos
For future reference, please request migration instead of cross-posting.
17h
comment Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?
If the AV is doing this for all HTTPS connections, regardless of certificate validity, then you definitely do have a problem. As long as everything is running through the SSL proxy, and the SSL proxy is trusted by the browser, you have no way of knowing when a site's certificate should really be trusted or not.
1d
comment Arbitrary code execution by opening a webpage by IE?
@programings For Windows XP, if you're running as an Administrator, yes. For Vista or later, it depends on the UAC configuration you have for your system and whether or not you just click-through unsolicited UAC warnings.
1d
comment Is Firefox Password Manager less secure than LastPass?
A key difference between Firefox and LastPass is that the former is open-source. Would be interesting to see someone review the code to the password storage and sync functionality in Firefox and compare them to whatever details are public for LastPass.
1d
revised Arbitrary code execution by opening a webpage by IE?
added 29 characters in body
1d
answered Arbitrary code execution by opening a webpage by IE?
1d
comment wifi devices connected even if they give a wrong password, how can i use this vulnerability
Example: I have MAC filtering enabled at home, in "whitelist" mode. This means that only the devices I add to the authorization list can connect. However, for ease of use, the system also contains a list of MAC addresses for devices which are trying to connect. This makes it easier for me to add new devices, but does not automatically permit them access even if they have the correct password.
1d
comment wifi devices connected even if they give a wrong password, how can i use this vulnerability
I'm confused. What do you mean by "subscribe" or "saved as valid devices"? If you are using MAC Address filtering, then the filtering should be based upon separately-known lists of authorized or unauthorized devices. The WiFi system itself should not, without authentication and proof of authorization, be automatically whitelisting devices just because they try to connect. However, the system will probably log their activity and register them in a list of known assets - but presence on this list alone should not imply that the assets are authorized for access.
1d
comment Is a server absolutely safe if the attacker don't know unknown bug?
@shidangai Really, the question is not even valuable in the first place because it is so far separated from reality. See my update to the answer - it also would address your suggested revision.
1d
revised Is a server absolutely safe if the attacker don't know unknown bug?
added 1965 characters in body
1d
answered Is a server absolutely safe if the attacker don't know unknown bug?
1d
answered What are the pitfalls of repeating a password multiple times for increased length and entropy?
1d
answered how to gain root access to linux machine?
2d
comment Is it possible to modify the last time a user logged into Windows?
@Thebluefish True. Digital signatures are just another roadblock, here but they can be bypassed. Now, what's really tricky to get around is a system that's sending a live stream (or fairly frequent export) of its event logs to an aggregator. Then you've got two systems to worry about compromising and cleaning up after yourself on.
2d
comment Is it possible to modify the last time a user logged into Windows?
Assuming it's possible to gain privileges to arbitrarily write to the Event Log, and there's no particularly unique digital signature applied or checked for on it, (both of which I'm pretty sure are the case) I don't see why not. However, there are likely a lot of other artifacts you'd have to mess with to render this change undetectable by an educated investigator.
2d
comment Configuration file with 12-character XML-encoded passwords
@Dillinur Unfortunately, that is not an option. If these "hashes" can be easily broken, or do represent cleartext passwords, I would not want to have them on a public forum.
Nov
21
revised Is storing CVV compliant with PCI standards?
Trying not to name names, and combine everything into a single coherent question.
Nov
21
reviewed Close My site is being redirected to an app site when anyone tries to access site from an ipad
Nov
21
revised Configuration file with 12-character XML-encoded passwords
deleted 4 characters in body