lzam
  • Member for 7 years, 5 months
  • Last seen more than 1 year ago
Can viruses steal MAC addresses? Why is MAC address bad?
Accepted answer
12 votes

Yes, software running on your computer can find your MAC address. If you have a malware infection, your MAC address leaking is probably not greatest of your worries (keystroke loggers, and RAM ...

View answer
What kind of factor is a physical signature?
Accepted answer
8 votes

I would consider a physical signature a biometric, albeit a pretty weak one. It isn't really something you have, since unlike a physical token, it cannot be stolen, or given to another (or, under most ...

View answer
How vulnerable am I on a unencrypted public WiFi network?
Accepted answer
7 votes

If you are on unsecured WiFi, all of your internet traffic is broadcasted for everybody nearby to see. This means that any traffic to/from your computer that is not encrypted at another layer (such as ...

View answer
Trying to understand why signatures in root certs "are not used"?
6 votes

For non-root CA certificates, the browser can only verify the certificate by validating the signature of the certificates hash. If the signed hash was generated by a weak algorithm, an attacker may be ...

View answer
What does 'verified file' in Windows mean? And does it guarantee related files?
Accepted answer
4 votes

When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file (see this MSDN ...

View answer
Preventing users abusing emailing feature of web application
Accepted answer
3 votes

There are a few things you can try to help prevent malicious actors from abusing your service: Require a CAPTCHA: This should help cut down on bots abusing your services. Limit usage of this feature ...

View answer
How can I secure my api to avoid copying?
Accepted answer
3 votes

The first thing you should do is to ensure that all communication between your app and the server uses HTTPS rather than HTTP. This should protect you from casual packet inspection. To make this setup ...

View answer
Can anti-CSRF token prevent bruteforce attack?
2 votes

CRSF attacks work by tricking a user (usually already logged in), into performing a request that servers the end of the attacker (either by getting him to click on a hyperlink, through a method such ...

View answer
What role do hashes play in TLS/SSL certificate validation?
2 votes

Usually, digital signatures are not actually applied to the full data. Instead, the data (in the case the x.509 certificate) is hashed, and only the resulting hash is signed. If this were not the ...

View answer
Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?
1 votes

A man-in-the-middle attack, by definition, involves impersonation. The basic idea is something like this: Alice wants to have a conversation with Bob. Mallory tricks Alice into sending the first ...

View answer
Virus (or Trojan) in Android
1 votes

If the app's malicious payload copies itself to other apps or documents on the device, it is a virus. If the app spreads itself to other devices, but does not do so by "infecting" legitimate apps or ...

View answer
Will a switch only send data to its recipient?
1 votes

If you are concerned that your ISP provided router may be compromised, you should replace your router with one that is under your full control. Unfortunately, with the pitiful state of home router "...

View answer
Does WPA2 Enterprise protect against evasdropping from within the network?
1 votes

If I understand correctly (wireless networking is not one of my areas of expertise), WPA2-Enterprise negotiates a unique encryption key for each client, which should make passively sniffing the WiFi ...

View answer
Contactless session on ATM?
0 votes

An RFID ATM card (using traditional RFID with one way communication) doesn't sound like a smart idea. If an attacker could get close enough, he could simply record the ID that the card broadcasts, and ...

View answer