New answers tagged

0

Direct answer Did you aleady read page 11 and 12 of this document, chapter 5.1, about Prevalence of Vulnerable Systems and 5.2: Countermeasures? If your system is really vulnerable, then yes, you have to flush cache of sensible information before accessing suspect web pages. But if your cryptographic tool uses non-cached memory, they are not ...


1

I'm not going to go into the technical aspects - others have already answered that, and it's not really what the question is about. Rather, you can say a couple of things. My answer will be somewhat US centric because that's what I'm familiar with, but similar examples will exist elsewhere. It is also somewhat broader - rather than specifically focusing on ...


1

This depends on the service used to ship the goods. Certain services (e.g. GLS in Germany) will allow you to reroute the parcel to a nearby GLS-Hub after it has been sent on its way. By using social engineering and the hotlines of delivery services one might be able to divert parcels of other services too. Most delivery services will only allow you to ...


0

I have personally performed the Cold Boot Attack before, it definitely works. I mainly referred to the actual Princeton paper (google princeton cold boot)as well as the McGrew link I used dry ice instead, have to beware of condensation (use tissue to wipe) since the RAM is colder than surrounding air. The time frame in which to pull and plug in the RAM is ...


-2

Cryptography is the technological equivalent to the Bill of Rights. Just like, say, the right to a fair trial sometimes seems silly when the case is crystal clear, we anyway would not want to do away with it just for the convenience of an exception.


3

There's plenty of good answers here, but I'd like to point out one non-security answer: your friends always say that it's fine to break encryption for "bad guys/criminals/terrorists". But that's not how this is going to be used, even in theory (and law). Whatever the approach, this will apply to anyone suspect of being a "bad guy/criminal/terrorist". And ...


5

Cryptography provides not just security, but also privacy. So the same arguments that apply to debates about privacy vs. safety also apply here. With privacy vs. government surveillance, many may argue, "if you don't have anything to hide, you have nothing to worry about!" ACLU and other organizations have made excellent articles to respond to that ...


3

Ask them if they would be okay with the bank storing their PIN and account number on pieces paper on a billboard in front of the bank. Or their porn viewing habits on front of their house. Cryptography is literally everywhere. Discussing what-ifs doesn't change the fact that cryptography will never go away, it's like trying to have a discussion about the ...


31

My response here is likely many in a sea of answers, but here's the breakdown of why encryption is good, why it's vital, and why breaking it is pointless. - Congress investigation found not a single terrorist plot was stopped by the NSA. So it's all taxpayer's cost for no profit See here. FBI Coleen Rowley at the London's whistleblowers conference ...


-5

[Non-techie friends] clearly would say "no, i do not want the government to have a copy of my house key and watch me doing private stuff. But if they are looking for a terrorist/criminal, it's fine to break the door". It sounds like your non-techie friends are onto something. As most answers have said, this isn't a technical question, it's an ...


7

I am going to take a bit of a different turn to answer the question. It is impossible to prevent the use of encryption, so everyone should use it. If for some reason encryption were to be banned, what would prevent people from using the current algorithms and transmit data? All data is is bytes so you could not even prove that it was encrypted in the ...


3

The primary reason why encryption exists, particularly public encryption, is that many clients must be 'publicly' able to send secret messages or communication,which is not only used by facebook and google, but pretty much the whole internet. Today, we are moving to a world, where everything can be done online,from transferring money overseas(online banking) ...


1

A hacker that just has a tracking number won't be able to do very much with it on it's own. However, if a hacker can gain access to the logistics database of the shipping company's entire operation, that tracking number, if the hacker so chooses, can then change the destination address in the system as an update and pretend that you initiated that change. In ...


9

The way I like to explain things to people is through movies. Last night I watched the movie Sneakers. The entire plot of the film is about a "little black box" that can break any encryption anywhere. SPOILER After stealing the box from the University Professor who invented it, it gets into the hands of the bad guys- the head honcho himself explaining ...


58

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect you from ordinary criminals who want to steal your money and hijack your computer for their own ends. The question is, will you concretely give up your safety ...


16

I agree with the "It protects your bank transactions" answer, but I'd like to add a few thoughts: Even if the government banned encryption or forced a backdoor, it wouldn't stop terrorists. Encryption isn't a physical good- it's a mathematical process. Banning encryption would be like banning adding or multiplying (or large semiprime numbers)- criminals ...


67

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop downtown in the middle of the road does that mean we must all poop with door open? Simply because the pile of poop was gathered in a bathroom?


5

Try thinking just as much of how you present as much as what you present I'm going to present my argument with a few attention grabbing words here... but in truth what you need to do is start a discussion much life we do here. A good way is to grab their attention. If a knife is used to kill a man, is that knife evil? Obviously the answer to that is no. ...


16

This is kind of a twisted point to make to anyone who's not familiar with the most trivial details of encryption and security, but I think it stands. Zach still said it best. Encryption is the equivalent of keeping your pants on when you visit the Internet. It should be basic, and it's not our fault that banks and stores are willing to forgo a "no shirt, no ...


45

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that could tell the authorities where they’d been, who they talked to, and what they were talking about. The authorities, at the time, considered these people ...


2

It does provide a security risk, though it may not be a huge one. What that shows is actual code, which reveals: The language your backend uses (at least I hope that's your backend code - if you're doing a database query on the client side, you'd be revealing far too much information to them), and possibly some of the libraries that you're using. ...


6

Any information about the internals of a system or application helps an attacker craft a specific attack. For instance, that error message includes table names, which means it becomes far easier to craft a SQLi attack. In addition, with detailed error messages, I could try to trigger different errors to map out the function of the backend, and even find ...


79

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys on our houses, I would not blame warrantless searches by government and companies in our homes.


13

Use the same terrible logical argument that the RIAA used in their anti-piracy propaganda pieces from the early/mid 2000s. You use an armored car to securely move money, encryption is that armored car for transactions on the internet. --or-- You keep your valuables in a safe, so you want to keep your data encrypted. --or-- You keep your front door ...


26

To explain "cryptography" in your scenario requires an understanding of the value of "private communications". It's not about the technology, but about the benefit to society of being able to communicate privately, even from the eyes of your neighbours (i.e. those charged with governing the society). This is more of a philosophical debate than a technical ...


-2

I would try to use an analogy that doesn't employ logical fallacy. This is difficult, but perhaps explain how cryptography is used in banking, healthcare, etc. to ensure privacy, security, and the integrity of services. Ultimately it is our responsibility to make sure they understand it, everyone needs to understand it now that it has become a ...


326

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is morally neutral. Encryption does not work differently depending on whether the attacker is morally right and the defender morally wrong, or vice versa. It is all ...


3

Look at the chain of custody. At the point of origin, you have a client; the client has a computer with a secret document, a ZIP program on it, and a secret password. At the point of receipt, you will accept the ZIP file, decrypt it with the secret password, and process it. We can assume that you and your clients are equally susceptible to attack at the ...


3

There are always risk, the ones you are asking about have more to do with physical access and physical loss of the media. As many others have mentioned encryption is going to play a big part in helping with your solution. I'd recommend taking a step back and looking at the specific risks that concern your business and this data in particular then creating ...


8

This is an everyday event not worthy of a CVE. It sounds like in this case it could be a simple mistake however the following are useful steps you can take or at least consider for any situation where credentials have been discovered. Contact the affected users if appropriate: The best way to help if this were a case of a public dump of passwords would be ...


4

You cannot open a remote file with GPG through FTP. Instead you would need to download the file to the local system and open it there. Because of this the decryption will be done only locally (and will be independent from that way the file arrived on the local system) and thus password for the file will thus stay local too.


0

The more information third parties have about a consumer the more accurately they can profile what causes a consumer to make decisions. Simply knowing what app's are on a mobile device can reveal a lot of demographic information about the user (think dating apps, news apps, religious apps, type of games purchased, etc). Likewise the type of hardware you are ...


1

All processes running as your user can read the contents of your clipboard and modify the contents. The KDE clipboard, called Klipper when I last used KDE, also stores previous clipboard history. It stores it by default in a text file. This means that the contents can be recovered from your hard drive by a forensics examiner or malware. You can disable this ...



Top 50 recent answers are included