11,697 reputation
743103
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 6 months
seen 1 hour ago

I'm not the droid you're looking for.


1d
reviewed Close Is it possible to ping a LAN card through its MAC address?
1d
comment Websites Forcing Weak Password Standards (Updated)
You forgot the option of just switching to a different provider for the services offered by the site. Not always an option, certainly, but one that should at least be considered where possible.
1d
reviewed Close Spying cellphones
1d
reviewed Close So how much anonymity is effective?
1d
comment So how much anonymity is effective?
Law #9: Absolute anonymity isn't practically achievable, online or offline.
1d
comment Does clicking lead to DoS attack?
Nobody needs to write a program to click on your links. They just need to write a program that duplicates the requests that are generated when those links are clicked. This can be done much faster than anything that has to simulate UI interaction, and doesn't even need to wait on your site to process one request before the next is sent.
1d
comment A folder lock/encryption program that can do this?
Any software that's doing encryption properly will prevent access to the protected data regardless of what happens to the Operating System - so long as the data is not currently unlocked by an authorized user.
1d
reviewed Close A folder lock/encryption program that can do this?
Jul
26
comment Can sites which check your password as you type pose a security risk?
@sapi Oh, sorry. I misread. Are you certain it's actually checking for correct username/password pair? Have you tried typing a wrong password which otherwise meets the site's complexity requirements? For example, try adding another character to your password at the end or changing one of the characters in your password to a different character of the same type (e.g.: if it's a lowercase letter, change to a different lowercase letter). Does it still give you a check-mark then? What about the right password but wrong (but correctly formatted) username?
Jul
25
comment Can sites which check your password as you type pose a security risk?
Additionally, checking the password as you type is not demonstrative of the site storing it in the clear or with encryption instead of hashing. It's much more probable that the site is not storing it at all (only retaining it in memory long enough to check it and provide a response - and even then, again, this is probably done client-side so the server doesn't even have it in the first place) until you submit the form. Then, if they're responsible, it's most likely salted and hashed properly. Why are you assuming the unlikely case that this is not done client-side again?
Jul
25
comment Can sites which check your password as you type pose a security risk?
I highly doubt that these sites are checking your password as you type server-side. Aside from being a security risk in and of itself, it means much more network and system overhead for the server. It's most likely that the password is being checked via a client-side script. In either case, the cleartext password is probably discarded after the check result is provided to the user and/or after form submission. So the only attack you would have to worry about is capture in transmission, which should be encrypted via SSL and (if the check is client-side) not happening anyway.
Jul
23
comment Open list of adult websites for child internet
Trying to block [all things of categories x,y,z,...] on the Internet is, for all practical purposes, impossible with blacklisting. If you really want to restrict your child's view of the Internet, you should use whitelisting (permitting traffic only to select approved sites/services). However, this quickly becomes a management overhead nightmare as they grow older and have legitimate educational and developmental needs to broaden their view of the Internet. Besides, they'll just end up browsing whatever you don't want them to see on their phone anyway.
Jul
22
reviewed Close Edit/Remove Timestamps for files and file system
Jul
21
reviewed Reviewed Tools to make a security researchers life easier - tracking vulnerability research
Jul
21
answered Do non-browser clients work around Gmail's 2-factor authentication?
Jul
18
answered Hacking own computer
Jul
17
reviewed Close How safe is virtual box without internet
Jul
14
revised PGP/GPG verifying authenticity
added 135 characters in body
Jul
14
comment Is it possible to track a missing brand new phone?
I'm kind-of on the fence, here. The question really does present itself as an XY Problem. However, even though the proper solution to our "problem X" is out-of-scope for this site, a question about the "solution Y" could still have value.
Jul
14
comment Can I get a public key from PGP signature?
Also note the WARNING starting on the fourth-from-last line. While you can get the public key information, it's of limited value unless you can also confirm the key itself is trustworthy.