13,728 reputation
852117
bio website security.stackexchange.com
location Florida
age 32
visits member for 4 years, 2 months
seen Mar 19 at 20:57

I'm not the droid you're looking for.


Mar
19
comment How can I be sure Lastpass really can't access my passwords?
@OlivierCailloux This is a public Q&A site which has zero affiliation with LastPass whatsoever. While I agree that it would be great to see a published audit, I think it speaks volumes that anyone at LastPass has bothered to comment here at all.
Mar
19
comment Is there any way to check the certificates in a client's root CA store?
@Xander Good point - putting an even sharper "spear" in "spear phishing".
Mar
13
comment How strong is visualCaptcha?
I'd argue this is actually weaker. A lot of Captcha circumvention services these days are actually using humans instead of computers. For a human, it's much faster to click on one thing than it is to type several characters or a couple of words. Therefore a human-driven Captcha circumvention service would be able to attack this form at a significantly higher rate than traditional Captcha.
Mar
12
comment Is sending passwords through cellphone text messages secure?
@supercat Also, the question here appears to not particularly be about a "one time code" case. It seems to be regarding password sharing between individuals.
Mar
12
comment Is sending passwords through cellphone text messages secure?
@supercat True, but ultimately that is still after-the-fact mitigation. You're dealing with a security compromise that could/should have been avoided by using more secure communications channels and/or implementing other, more robust security enhancements.
Mar
10
comment NMAP Scan Returns Odd OS Detection
We definitely need more information about the original nmap options used, and further details from the nmap output. Also, it would be helpful to know what the device actually is - if you're "100% certain that this device is not a printer" then you must have some amount of certainty about what it is.
Mar
10
comment How to enforce TLS on Windows
@Escoce That's definitely going to cover the bulk of your work, but be very mindful of the last few paragraphs - particularly the bit about SSL/TLS not only being for websites, and how non-Microsoft applications are not necessarily affected by those Registry entries.
Mar
10
comment How to enforce TLS on Windows
I'm just going to leave this here. support.microsoft.com/kb/245030
Mar
9
comment AutoRun/AutoPlay in Windows 8
@KnightOfNi Yeah. That's why I used "attack vector" in my OP. ;-)
Mar
9
comment AutoRun/AutoPlay in Windows 8
@KnightOfNi If it's taking any information from autorun.ini or other data sources on the drive to present options to the user (like logos, device name, etc.) there still remains a risk that flaws in handling such data can lead to improper presentation of options or even code execution. This was at the heart of some AutoRun/AutoPlay vulnerabilities in the past, if I recall correctly.
Mar
9
comment Who should I give my password to
@Ohnana Unfortunately, this is an all-too-common practice in corporate environments. I worked on a migrations team awhile back (moving from NT to XP) and this is exactly how we were told to handle user accounts. Usually, we would reset the password afterward and force a change at next login. But changing before the migration, and using a temporary password throughout, was a rare exception. This is also how I first learned, first-hand, how laughably pathetic and predictable most users' passwords are.
Mar
9
comment Who should I give my password to
I disagree with both of these options. Either way allows the migrations team to autonomously act under the user's identity in a way that is not documented by the system. See my answer for a more appropriate alternative.
Mar
9
comment How can a domain be impersonated with a fraudulent SSL certificate?
Compromised Root CAs are also useful to any MitM between the client and its Internet gateway. That's essentially how corporate SSL proxies work, though in those cases the Root CA isn't technically "compromised".
Mar
6
comment Why do phones have SIM cards?
"three hours to Tanzania imply a non-negligible amount of money" - What about for local Tanzanians? I should hope they get some sort of resident discount. ;-)
Mar
6
comment Use WebGoat on Windows 8
@user2505650 Please don't cross-post. This question can be migrated. Also, you'll need to provide more detail. Like what you've done already, what errors have been encountered, etc.
Mar
4
comment Is creating secondary account on Black-Box Pentest Forbidden?
Your test should have included coordination and agreement to "Rules of Engagement" beforehand. This would have delineated what sort of testing was in-scope, and what sort of activities and data collection you were authorized to perform. If you acted beyond that scope, then you could be in trouble. If you acted within that scope, and the customer isn't happy, the situation may require some delicate negotiations.
Feb
28
comment Superfish vs. Corporate MITM
@immibis If the proxy is properly implemented, being on the client may not be a "problem" but it nonetheless still increases the risk of the proxy being compromised.
Feb
27
comment Superfish vs. Corporate MITM
@immibis No, that only exacerbates the problem described by Charles. If Superfish was configured to not trust its own CA when validating external sites, a leak of the Superfish key wouldn't even be an issue. Besides, there still remains the other problem of Superfish not performing proper certificate validation to begin with. There's ways to trick Superfish into accepting any certificate you give it regardless of the CA, which means that you don't even need Superfish's key to do a MitM attack.
Feb
26
comment Superfish vs. Corporate MITM
@mehaase The problem there is a 30-page AUP. A good AUP is like a good resume. One or two pages, tops. Don't drown the user in crap they'll never read.
Feb
26
comment Superfish vs. Corporate MITM
@mehaase The users signed agreements, and many corporate policies require that the systems notify them at each login (e.g.: a "warning banner"). If the users claim oblivion beyond that point, it's their own fault. That said, there's also a lot of places that put an allowance for monitoring in the AUP and system notice but don't actually do SSL proxy.