11,697 reputation
743103
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 6 months
seen 3 hours ago

I'm not the droid you're looking for.


6h
comment Is there a secret-sharing public-key-encryption-based service?
Depends on what you mean by "trustworthy". There's plenty of systems/services out there. But unless you're generating and controlling access to the keys yourself, you cannot be confident that the system/service itself doesn't have access to your data - then you need to decide how much you trust them to not abuse that access, or to not be hacked such that an attacker can abuse it.
2d
comment Websites Forcing Weak Password Standards (Updated)
You forgot the option of just switching to a different provider for the services offered by the site. Not always an option, certainly, but one that should at least be considered where possible.
2d
comment So how much anonymity is effective?
Law #9: Absolute anonymity isn't practically achievable, online or offline.
2d
comment Does clicking lead to DoS attack?
Nobody needs to write a program to click on your links. They just need to write a program that duplicates the requests that are generated when those links are clicked. This can be done much faster than anything that has to simulate UI interaction, and doesn't even need to wait on your site to process one request before the next is sent.
2d
comment A folder lock/encryption program that can do this?
Any software that's doing encryption properly will prevent access to the protected data regardless of what happens to the Operating System - so long as the data is not currently unlocked by an authorized user.
Jul
26
comment Can sites which check your password as you type pose a security risk?
@sapi Oh, sorry. I misread. Are you certain it's actually checking for correct username/password pair? Have you tried typing a wrong password which otherwise meets the site's complexity requirements? For example, try adding another character to your password at the end or changing one of the characters in your password to a different character of the same type (e.g.: if it's a lowercase letter, change to a different lowercase letter). Does it still give you a check-mark then? What about the right password but wrong (but correctly formatted) username?
Jul
25
comment Can sites which check your password as you type pose a security risk?
Additionally, checking the password as you type is not demonstrative of the site storing it in the clear or with encryption instead of hashing. It's much more probable that the site is not storing it at all (only retaining it in memory long enough to check it and provide a response - and even then, again, this is probably done client-side so the server doesn't even have it in the first place) until you submit the form. Then, if they're responsible, it's most likely salted and hashed properly. Why are you assuming the unlikely case that this is not done client-side again?
Jul
25
comment Can sites which check your password as you type pose a security risk?
I highly doubt that these sites are checking your password as you type server-side. Aside from being a security risk in and of itself, it means much more network and system overhead for the server. It's most likely that the password is being checked via a client-side script. In either case, the cleartext password is probably discarded after the check result is provided to the user and/or after form submission. So the only attack you would have to worry about is capture in transmission, which should be encrypted via SSL and (if the check is client-side) not happening anyway.
Jul
23
comment Open list of adult websites for child internet
Trying to block [all things of categories x,y,z,...] on the Internet is, for all practical purposes, impossible with blacklisting. If you really want to restrict your child's view of the Internet, you should use whitelisting (permitting traffic only to select approved sites/services). However, this quickly becomes a management overhead nightmare as they grow older and have legitimate educational and developmental needs to broaden their view of the Internet. Besides, they'll just end up browsing whatever you don't want them to see on their phone anyway.
Jul
14
comment Is it possible to track a missing brand new phone?
I'm kind-of on the fence, here. The question really does present itself as an XY Problem. However, even though the proper solution to our "problem X" is out-of-scope for this site, a question about the "solution Y" could still have value.
Jul
14
comment Can I get a public key from PGP signature?
Also note the WARNING starting on the fourth-from-last line. While you can get the public key information, it's of limited value unless you can also confirm the key itself is trustworthy.
Jul
14
comment Can I get a public key from PGP signature?
Bear in mind that, while it may be possible to get the public key, you should still also verify the key itself (e.g. verify trusted third-party signatures on the key, or contact the owner out-of-band) before trusting the signature.
Jul
10
comment How did my network admin identify my iPhone and how can I hide my ID?
"How to stay unnoticed in a professional network" really needs just three words: "Stay off it." Note that this is an all-inclusive statement, covering wireless, wired, or any other connection. If you're on a managed network, and doing things the network admins don't like, they can find you. This is especially applicable if "things you're doing that the network admins don't like" includes "hogging all the bandwidth".
Jul
9
comment PGP/GPG verifying authenticity
Key management, and particularly establishment of trust in the sender's key, is a critical requirement for the recipient to be able to trust the sender's signature. I'd hardly consider it out-of-scope here.
Jul
9
comment how to scan a web application that uses Captcha
+1 for the last paragraph. Rest of it's good too, but I think that last part really needs to be emphasized here.
Jul
9
comment how to scan a web application that uses Captcha
Not sure I'd go the non-Captcha route, if there's alternatives. The Captcha component itself may have vulnerabilities which your scan will miss when it's removed. Also, you do realize that by putting the Captcha into machine-readable text on the page you've effectively defeated its entire purpose - don't you?
Jul
8
comment How did my network admin identify my iPhone and how can I hide my ID?
Note: With the proper equipment, the network admin can find your location within a few feet (much less than 25m) if they're so inclined. However, that's more likely to result in a face-to-face discussion (since they're already there, tracking down your device) than an e-mail.
Jul
7
comment untangle server at work place privacy
+1 to @RoryAlsop. I'm not sure if we've got a canonical "can my employer see what I'm doing at work" question here yet, but my answers to these always include something along the line of "leave your personal stuff at home".
Jul
7
comment untangle server at work place privacy
...or that users click through an "Untrusted Certificate" warning in their browser. Chat clients and other applications may not be so tolerant, but most web browsers will allow users to optionally proceed despite problems with SSL certificates - and many users are happy to click through anything that stands between them and [insert web application of choice].
Jul
3
comment What Steps Does An Anonymous Artist Need To Take to Retain Anonymity?
See Law #9.