13h
awarded  Critic
Jul
25
comment Suspicious GitHub mirror site (https://hzb.world/)
It's being fronted through CloudFlare; I submitted a phishing report to them as well.
Jul
25
comment UserName and Password information can be seen on https
@MuhammadAliKhamis ZAP is a man-in-the-middle proxy, meaning that it sits in the middle of a normally-encrypted connection. The only reason it can do this is that you trusted its certificate on the client, which allows it to impersonate the server.
Jun
29
awarded  Yearling
Apr
18
comment Spam Russian Subdomains on my Website
I'd see if you can register with Google's webmaster tools, and see if it can tell you anything about where/how it found those subdomains.
Apr
18
comment Spam Russian Subdomains on my Website
I've done DNS lookups on several of the subdomains, and not found entries in the current (Apr 18 07:30 UTC) DNS tables; trying to visit the domains gets me errors consistent with this. I also tried sending an HTTP request to your server asking for one of those domains, and got a 404 error. (If you see two entries in your web server log relating to one of those, just before 7:30 UTC, that was just me). So I don't see anything live right now (though I might've missed something), but apparently there was something at some time, when google crawled those sites.
Mar
7
comment Should I use HTTPS on a domain that will only be used for redirection?
@Fax HSTS isn't fully secure if your site isn't on the preload lists, but it's not useless either, because once a client connects without being MITMed, they'll load the correct HSTS policy, and they're no longer vulnerable. Thus, an attacker must catch the client on first connection, or they've lost their opportunity.
Jan
8
comment Is it possible to make a login safe without a TLS certificate?
You're talking about transmitting the user's password in plaintext (in the POST request), which is far from safe. It's technically possible to get good security without SSL, but it basically involves re-inventing SSL. There are some similar previous questions here and here.
2018
Nov
4
comment Which is the main purpose of having two domains pointing to the same IP, one of them without SSL/TLS?
If you try to reach the one that has TLS without using TLS (i.e. use http://www.domain.com/), does it redirect to the https version of the site? This is a fairly common setup, and if that's the case here then www-org.domain.com may exist as a don't-upgrade-to-https option.
Nov
4
answered Is an authenticated server seeing the plaintext password a serious problem?
Jun
29
awarded  Yearling
Jun
1
comment Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
@thebunnyrules You're still in danger if an attacker can control part of a file (and predict what comes before the part they control). That's essentially the situation with the cert collision: a legit certificate authority created the certificate, but the "attacker" was able to control parts of the generated certificate and predict the rest; that was enough. In your case, if no attacker can control any part of any of the files, attackers are stuck with a second-preimage attack, which MD5 isn't known to be significantly weak to. But I'd still rather truncate a better hash.
May
30
comment Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
It's not quite enough that the files are not "created by an attacker" -- even if an attacker only controls part of the files, they may still be able to force a collision.
May
30
comment Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?
Small files aren't safe. The 2008 rogue CA certificate used an MD5 collision on a "to-be-signed" part of only 927 bytes, and only needed control of 204 of those bytes (the "collision block") to create the collision.
May
20
answered What encryption method is used by the zip program in macOS?
Apr
22
comment my email just hacked, no 2 factor auth. request or new sign in? Am I infected?
This happened to a lot of people with gmail accounts today (see Gmail help forums: My account is sending spam emails). Apparently telus.com had a problem with their SPF config, and some spammer was taking advantage of it. That, and for some reason Gmail trusts the "From" address (which it really shouldn't).
Apr
17
comment Dictionary Attack on SHA-1 hashes
It's looking for dictionary.txt in whatever the user's working directory was when they ran the script, which might be different from the directory the script's in.
Mar
10
answered Wrong user or IP in High Sierra terminal
Feb
10
revised Is it possible to “encode” a bash sentence?
Minor clarification
Feb
10
answered Is it possible to “encode” a bash sentence?