55,286 reputation
392236
bio website
location
age
visits member for 3 years, 7 months
seen yesterday

Aug
24
comment Hacking Gmail with 92 Percent Success - Does popular GUI framework designs reveal UI state change ?
Well, that paper doesn't exactly show that Gmail can be hacked with 92% success rate. (The hint is in the word "hacked". What that paper achieves is interesting, but it doesn't qualify as what we'd normally think "hacked" would mean. They can infer which app is active and which Android Activity is currently being displayed on the screen. That's not what most people would consider as "hacked". It's an interesting ability that might enable further attacks, such as phishing attacks, but wouldn't call Gmail "hacked".)
Aug
22
awarded  Nice Answer
Aug
22
comment Obfuscate IDS rules
Thank you for pointing me to that paper, @RickyDemer! That's indeed highly relevant. On the merits: I don't believe that paper will work in practice. Their technique does not hide which module or function in the code is getting changed, so it would immediately point the reverse engineer to which part of the code has a bug, which would be a huge leg up enabling attackers to re-discover the bug. Also, I don't immediately see how to use this to obfuscate IDS rules. But thanks again -- a good find!
Aug
21
asked Obfuscate IDS rules
Aug
21
awarded  Notable Question
Aug
18
awarded  Announcer
Aug
15
awarded  Nice Question
Aug
15
revised The registration confirmation email contains my password: do they keep it in plaintext?
Elaborate on the answer, to make it clearer.
Aug
14
comment Drive-by downlad VS buffer and stack overflow attacks
What research have you done? Wikipedia has articles on these subjects: en.wikipedia.org/wiki/Drive-by_download and en.wikipedia.org/wiki/Buffer_overflow. You might start by reading them, and by searching on this site (see, e.g., security.stackexchange.com/q/64286/971 and drive-by-download and buffer-overflow). If your question is answered by Wikipedia, by other questions on this site, or by standard sources of information on security, you probably haven't done enough research before asking.
Aug
14
revised What does “sandboxing” mean for Chrome OS?
One question per question. Remove the separate question about Chrome OS vs Cent OS.
Aug
14
comment What does “sandboxing” mean for Chrome OS?
2. Please stick to one question per question. You currently have two questions: "what does sandboxing mean for Chrome OS?" and "is Chrome OS more secure than CentOS". That is not appropriate. Also, the latter question is too broad and too subjective to be a good fit.
Aug
14
comment What does “sandboxing” mean for Chrome OS?
1. What research have you done? There's lots written about this on the net. We expect you to make a serious effort to answer your own question before asking here. For instance, Wikipedia has an article on sandboxing at the obvious place. If there's a Wikipedia article that largely answers your question, then you haven't done enough research. Same if there's a question here on the site that is easily findable through search (such as the article Shadur pointed you to).
Aug
14
awarded  Nice Answer
Aug
13
comment Can my workplace view my Tor traffic?
In the future, please do more research before asking, and show us in the question what research you've done. Your question is covered well by other questions with the tor tag. See, e.g., security.stackexchange.com/q/1057/971 and security.stackexchange.com/q/27845/971.
Aug
12
comment Is client side encryption really better than server side?
@steshaw, the question is comparing client-side encryption to server-side encryption (not client-side encryption to nothing). So, the alternative is not sending the password in plaintext; the alternative is sending it over HTTPS. As my answer says, client-side encryption probably does not add enough over HTTPS to be worthwhile, for most web sites.
Aug
9
awarded  Announcer
Aug
9
awarded  Good Answer
Aug
7
awarded  Announcer
Aug
6
awarded  Good Answer
Aug
4
awarded  Deputy