10,946 reputation
63697
bio website security.stackexchange.com
location Florida
age 31
visits member for 3 years, 3 months
seen 18 hours ago

I'm not the droid you're looking for.


Apr
10
comment Can an external tool accurately determine the current vulnerability of a site to Heartbleed? How? Was vulnerability remediated?
@BillR security.stackexchange.com/questions/55083/…
Apr
9
comment browser extensions to show Heartbleed vulnerability?
All that information would be useful in determining how at-risk your current session is, and give you some idea of how your past sessions may have been compromised or not.
Apr
9
comment browser extensions to show Heartbleed vulnerability?
@Lekensteyn A good extension may be able to tell you: 1. Whether the site is running OpenSSL. 2. Whether the site is currently vulnerable. 3. Whether the site has PFS enabled. (Mitigates risk of using leaked certificate to decrypt past data. Caveat that this will only tell you the current PFS configuration, and doesn't guarantee the historical configuration.) 4. Date of issuance for the SSL cert. (Under presumption of past exposure, mitigation of the vulnerability is only effective after a renewal of the cert.)
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
@RubberDuck See here: explainxkcd.com/wiki/index.php/Category:Characters for a list of XKCD characters.
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
As you've said in your self-answer, it is not likely that Heartbleed can read memory from outside of the web server's own process. However, the important thing to bear in mind is that everything Megan enumerates in her first three lines may indeed be in that process' allocated memory space. Literally anything the website sends to or receives from its users is at risk, as well as some supporting data (e.g.: the private keys) required for the web server's operation.
Apr
8
comment HeartBleed - How to detect compromised websites
Note that changing your password on the site is only really valuable after the site has been patched so that it is no longer vulnerable.
Apr
8
comment HeartBleed - How to detect compromised websites
There are ways to determine whether a site is currently vulnerable, but what makes this issue so critical is that sites which are not currently vulnerable (but were in the past) may have been exploited before. There's no way for system administrators to know if their site has been previously exploited, and there is no way for users to tell if there's a MitM who's exploited a site because the attacker would be using the legitimate original certificates.
Apr
4
comment How many possible combinations in 8 character password?
@Adnan That's the number of possible passwords without restrictions on any of the characters - not what's being looked for here.
Apr
4
comment How many possible combinations in 8 character password?
This might be useful: math.stackexchange.com/q/497257
Apr
4
comment How many possible combinations in 8 character password?
Also of note, that password policy is ridiculously weak. 8-character passwords haven't been "strong enough" for quite some time. 12 is the new 8, but many are recommending 15, 20, or more. And please don't ever implement something that imposes a maximum length on the password. (Or at least, not a maximum that can be measured in two digits.)
Apr
4
comment How many possible combinations in 8 character password?
Your second suggestion seems right - and can be shortened to (26^2)*10*33*(95^4) - but something feels just a little off about it. Regardless, this is off-topic for Information Security. It might be on-topic for Mathematics. We'll see if they want it migrated.
Apr
3
comment Watching for applications like WireShark and other eaves dropping on corporate network
Of course, this assumes that only company-approved systems are attached to the network, and nobody is using these tools from a thumb drive, and nobody would ever use a Live CD...
Mar
24
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
Encryption on its own does nothing to prove that data in transit has not been modified. For that, you need authentication which is normally provided through digital signatures. This is also a component of SSL, but the two should not be confused.
Mar
6
comment How To Protect Tomcat 7 Against Slowloris Attack
Thanks for the links, but answers on StackExchange are expected to be primarily self-contained - that is, links to supporting documentation may be included but should not be relied upon to resolve the problem.
Mar
5
comment What is wrong with a confirmation page displaying my password?
Showing the password online and including it in an e-mail, as part of the registration process, doesn't necessarily say anything about the long-term storage mechanism - though it definitely indicates some bad practices. What's the password reset/recovery procedure like? i.e.: If you forgot your password, will they e-mail/show it to you?
Mar
5
comment What is wrong with a confirmation page displaying my password?
The most recent edit to the question indicates the password is also being e-mailed. So, regardless of how it is stored on the EventsOnline servers, it's most definitely being stored/transmitted insecurely at some point in the e-mail process.
Mar
4
comment Is storing plaintext passwords for email accounts any less bad?
@MattConnolly I believe Lucas meant to imply the use of salt when he said "performing correct password hashing". He probably just felt that the question is a bit too pedestrian to bother with providing any answer more complete than what he did - any security-minded individual with a lick of sense regarding the Internet should easily recognize that e-mail accounts are among the most high-value online accounts one might have (arguably more so than financial accounts) and therefore should be the last account for which cleartext password storage might be deemed acceptable or "less bad".
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
... Even if this could tell us whether hashing/salts are used, it still wouldn't help differentiate between bad practices (weak/fast algorithms, common salts) and good ones (strong/slow algorithms, unique-per-account salts).
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
@theGreenCabbage Usage of Recovery vs. Reset processes is not a good indicator to differentiate between good password storage practices and bad ones. While a Recovery process definitely indicates bad storage practices (though it does not specifically indicate cleartext storage - encryption, not as bad as cleartext but still a bad practice, may still be used), a Reset process can just as well be in place with cleartext storage as it may with hashed/salted storage. ...
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
Nevermind the fact that the e-mail account is typically a gateway to password resets for every other account.