Mar
5
comment Is divide-by-zero a security vulnerability?
i was on a project where we had to report a user-controllable divide-by-zero as a major security hole to the US government. users could craft packets that would cause a mod 0 operation, which causes divide by 0. the thing that got killed was an intrusion prevention system. so, you could turn it off with a crafty packet, just before you began an attack. of course this is a very strange and specific example.
2018
Aug
30
comment Is client side encryption really better than server side?
He's making an obvious observation about end-to-end encryption, that almost everybody running servers in the cloud seems to have forgotten.
Aug
30
comment Is client side encryption really better than server side?
I don't understand the downvotes on this. TLS protects you from rogue middle-boxes leading to the cloud provider only. TLS is plaintext on both ends of it, and if one end is inside the cloud provider, then it's not open to "everyone", but it is surely readily compromised by the service provider. It is a development effort for the cloud provider to break your crypto, but governments have the procedure down. First, your server cert is on the server machine.
Jun
19
comment Can secret GET requests be brute forced?
if it's over https, it's not as bad as passing in a password, or something that can also be used for other purposes.
May
18
comment Does password-protecting a database living next to the application add any security?
from the original post: "on the same server as an application holding the credentials to said database in plain text." this unfortunately, is a very common scenario. i would not say "no protection", but it doesn't protect you from anybody you would worry about. it's common because people want to be able to do an unattended reboot.
May
18
comment Does password-protecting a database living next to the application add any security?
this is the difference between protecting against incompetent snooping versus competent snooping. they can't simply run "strings" against the database files, but won't stop somebody that grabs the database and does a minimal amount of development to read all of it later.
Mar
25
awarded  Yearling
Mar
21
awarded  Nice Answer
Mar
16
revised Why is Math.random() not designed to be cryptographically secure?
edited body
Mar
16
awarded  Editor
Mar
16
revised Why is Math.random() not designed to be cryptographically secure?
minor edits
Mar
16
answered Why is Math.random() not designed to be cryptographically secure?
Jan
5
comment VPN + HTTPS = 100% anonymous?
In order to remain anonymous, you generally have to "launder" the source address, the timing, and the message sizes. Things like a client-cert may provide undesired correlations between connections.
Jan
5
comment VPN + HTTPS = 100% anonymous?
correlations: 1) the larger a (well-known) file is, the more likely that a (ciphertext only) size match indicates a file match...ie: how many 1GB + 357byte files are there?. 2) timing... if you want to watch a twitter account, you can look at the timing of connections.... ie: every tweet is preceded by a TLS connection 2s before from a consistent IP address.
Jan
5
comment VPN + HTTPS = 100% anonymous?
https is NOT the same as "end to end encrypted", unless you OWN both ends of the pipe (ie: from your laptop into your house TLS server). to twitter, one end is in YOUR machine, and the other end is in a data center. in the case of cloud services like AWS, the cloud sees the plaintext going into and out of its end of the pipe (ie: os.Read, os.Write); and you PRESUME that they don't abuse the privilege. But they have to respond to law enforcement requests to peek... so they can't hold up that bargain. Your IP shows up on your end of the VPN as well; obfuscate that with Tor.
2017
Nov
14
comment How are anti viruses so fast?
If you want to test hashes for set membership in really huge sets, use a bloom filter. Though I would imagine that AhoCorasick is more relevant to the main AV detect. A bloom filter (real world example) would be a set like, every hostname associated with divorce lawyers. It's an opaque bit structure that hides what is in it, and can give false positives; particularly as it get really full.
Nov
14
comment How are anti viruses so fast?
AhoCorasick is a multi-regex that can pattern match on many thousands of patterns simultaneously; a state machine that emits multiple events. With a first-pass of a regex, files get selected for deeper inspection. I know that's how we did firewalling and intrusion detection at wire speed; at Check Point, which also had an AV division.
Nov
6
comment How do mobile carriers know video resolution over HTTPS connections?
video watching is a real-time operation. in general, it won't download faster than it needs to; and it can't download slower without skipping. if you are watching a black ssl pipe going to www.iserversomevideo.com, then under the assumption that it is video, you map bytes/sec to an estimate of what the frame size or frame rate must be. browsers will download a few seconds of video until it is a few seconds ahead (in download) of frame playout. it will range request it to fill with more frames before it is late.
May
8
awarded  Nice Answer
2016
Aug
31
comment Company computers for competent developers, how can you deal with them?
A big uncontrolled space for containers and VMs is necessarily to get any development done; and it's a reasonable alternative to full control of the host machine. Contained web browsing is usually ok. Where you have devs wanting full control of the machine is where IDEs running in containers is too much of a pain or in VMs too slow. The idea that you will have only whitelisted binaries executing and opening ports is the opposite of what a developer needs. That is where the demand for control (often confused with security) creates an impossible situation.