Tales from the Crypto - All Comments

re: Removing capabilities from my first Windows Phone app

Till — Sun, 05 May 2013 20:33:55 GMT

Arg, this is really annoying! Microsoft.Expression.Interactions.dll causes ID_CAP_MEDIALIB to be included as an app capability. Can´t remove it as I use GotoStateActions and useres are seriously complaining about it as the app doesn´t need access to the media library

re: Credential Provider update–Windows 8 SDK breaks a few things…

Mao — Wed, 01 May 2013 19:29:19 GMT

There is actually a doc that explains the change in win8:

download.microsoft.com/.../Credential%20Provider%20Framework%20Changes%20in%20Windows%208.docx

re: Why changing passwords should be done regularly

Alun Jones — Sat, 20 Apr 2013 15:28:02 GMT

I actually suggest that people write down passwords if that allows them to remember longer and stronger passwords. Read msmvps.com/.../1779604.aspx, for instance.

In general, I suggest using an appropriate password safe - and I use one that works on my mobile phone as well as my desktop.

The only challenge, then, becomes trying to find out what's an 'appropriate' password safe.

re: Why changing passwords should be done regularly

Hobo — Sat, 13 Apr 2013 02:54:42 GMT

Of course, you ignore reality. With multiple systems having multiple password requirements in a business environment, you are creating an situation where users wind up keeping lists of passwords in drawers, under keyboards, last page of post-its...you get the idea. So, again, you have decreased security. Spend more time educating users on strong passwords and enforcing rules on not sharing pwds. Of course, that requires more effort and is not going to happen. Easier to just fall back on "best practices" and wash your hands of any responsibility when a breach occurs.

re: Windows 7 Explorer may corrupt MP3 files

Anon — Tue, 05 Mar 2013 01:34:05 GMT

I Have Just Had a Similar Problem. I tune amps and install radios, speakers, subs, etc. I save my testing tones on my laptop. Today I found out that Windows corrupted ALL of my test tones! X.XX MB files all turned into 4.05 KB files and are now ruined. Now I have to re-purchase All of my test tones! I've tried to recover them. The quality has been destroyed and is unusable for tuning purposes. Now I have to put my work on hold while I wait for new tuning cd's to arrive.

re: XSS Hipster loved Scriptless XSS before it was cool

Alun Jones — Wed, 09 Jan 2013 23:51:40 GMT

I should note that I'm not claiming to be the first to note that XSS isn't all about JavaScript - and even if I'm chronologically first (which I strongly doubt), I wouldn't say it's sufficiently non-obvious that I didn't expect other people to come up with it independently.

I only gave one effective demonstration, that of injecting a <form> tag in order to direct user input such as username and password to an evil site. Mostly this is because I felt it sufficient to note that defences against Cross-Site Scripting which only paid attention to JavaScript execution, and not to the injection and escaping themselves, were bound to fail.

If you want some other examples of how an attacker can attack by XSS without the use of JavaScript, lcamtuf.coredump.cx/postxss is a good page. As a defender, however, you shouldn't NEED more than one example.

re: Removing Apple Mobile Device Support

airone — Tue, 11 Dec 2012 01:08:02 GMT

Thank You for your help Mr!!! I do not love Lackintosh at all and I wasn't able to remove that invasive and useless "subliminal" applicatin, now I'm clean. Grazie! : )

re: EFS in a domain expires after three years

Bob — Mon, 12 Nov 2012 16:07:19 GMT

One of the first things Mat does when he joins a new company is to audit everything he can, which doesn't take long. Sounds like a pretty thorough audit that, or a conveniently small company.

re: Changing passwords on a service, part 3

Nik — Tue, 25 Sep 2012 23:53:09 GMT

Comrade Alun,

Greetings from Russia! Nice post about changing passwords on a Windows service.

If running as Local System, of course, service is going across as the computer account, and if computer account has any modify access in Active Directory, great place to start an <a href="www.active-directory-privilege-escalation-security-risks.com

">Active Directory Privilege Escalation attack</a> - wouldn't you agree comrade? ;-)

Thought I would give you something to think about.

re: Windows 7 Explorer may corrupt MP3 files

JOhn — Tue, 11 Sep 2012 22:35:01 GMT

I realize this is an old thread, but this has been driving me crazy for months. An Mp3 might have 1 second from another track. The size of the copied file is exactly the same. Just a bit of bad data.

re: Black Hat with Amazon.com–2011 Code Challenges II

carlos — Thu, 30 Aug 2012 21:19:33 GMT

Only a year late, but I can't resist a challenge! Did you ever post the answers anywhere? Here's my take anyway.

II: Broken with negative numbers, e.g. "-1.2" gives -0.8.

III: Sets auth tokens before validating the user. If the caller doesn't check the status correctly the user could be logged in with a bogus password.

IV: The boolean expression should be disjunctive.

V: Assuming there isn't a load of external synchronization between the two functions, there's no connection between the user and the command they want to execute. Global variables combined with multithreading have a very bad smell.

Oh yeah, and I: It's Perl :)

re: Multiple CA0053 errors with Visual Studio 11 Beta

John — Tue, 21 Aug 2012 07:37:34 GMT

Thanks!

re: Multiple CA0053 errors with Visual Studio 11 Beta

Terje Sandstrom — Sat, 18 Aug 2012 20:07:39 GMT

Added a tool to fix this in multiple files.

See visualstudiogallery.msdn.microsoft.com/471da13b-d415-4a44-a4e9-a8222316b902

Blogpost at http://tinyurl.com/9q8nnvh

re: Multiple CA0053 errors with Visual Studio 11 Beta

Jonathan — Fri, 17 Aug 2012 21:14:31 GMT

excellent, same issue with the RTM version

re: Error: Insufficient system resources exist to complete the API.

Er. Gopal Malviya — Sat, 28 Jul 2012 18:25:04 GMT

please delete hibernate file from your hard drive c: before do this disable hibernate option

after restart the system enable hibernate option

and enjoy with hibernating....

Thanks

Gopal Malviya

9893469598

re: How FTP Data Connections Work Part 2 (OR: Fun With Port 20)

JB — Mon, 23 Jul 2012 20:32:16 GMT

Interesting read, although with a recent problem with FTP from a single server ( other servers were fine ) , the FTP would only work if ALG was disabled from the client RRAS server.

re: Why changing passwords should be done regularly

Craig Anderson — Wed, 11 Jul 2012 06:06:13 GMT

So changing my password protects the system from me, rather than from outside hackers. I don't particularly like that, but it's reasonable.

re: Multiple CA0053 errors with Visual Studio 11 Beta

Dave — Fri, 01 Jun 2012 05:25:22 GMT

The internet is most grateful

re: Stupid Outlook 2007 RSS Feed Workaround

Robbie — Thu, 31 May 2012 19:32:24 GMT

Here is another DUMB workaround (or maybe just a restatement of what you said?). I ignorantly thought I could add these feeds from the File/Data File Management/RSS buttons and manually entering them. All I got was "pended" and then gone. Workaround? RIGHT CLICK the RSS feeds button in the Navigation Pane on the left. Then paste the link in the EXACT SAME D@MN BOX and lo and behold- it works perfectly. Priceless Microsoft. Priceless.

re: Windows 7 Explorer may corrupt MP3 files

dix — Tue, 22 May 2012 21:19:02 GMT

Same issue here - with the garbled mp3 situation (random bits of other songs, usually located "nearby" on the file hierarchy, but always from another folder, being inserted into otherwise fine mp3's). I had recently undertaken a big tag cleanup, and thought that perhaps that, or the fact I had the songs stored on an external drive, may be causing the error...but I can't duplicate, and other data on the hard drive seems fine.

I wonder if anyone here has tried to find *what* mp3's are corrupted out of possibly thousands without listening to every one, when the problem isn't zeroing out, but insertion of random data?