320 reputation
311
bio website
location
age
visits member for 2 years, 7 months
seen Dec 23 at 19:00

Nov
23
comment Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?
i.imgur.com/yd8fEXn.png i.imgur.com/Vf9qesN.png
Oct
31
comment Is it safe to use public USB charging stations?
I'm asking because they introduced some anti-theft measures: support.apple.com/kb/HT5818
Oct
31
comment Is it safe to use public USB charging stations?
"one can access most files of an iPhone without any special access" Did this change in iOS 7?
Jan
5
comment Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?
I'm rather unfamiliar with the technical side of SSL, but if I'm not mistaken this was a human error. Are there any SSL alternatives/improvements that can eliminate the possibility of human errors by certificate authorities? And then I'm not even considering the possibilities for hackers and governments to sabotage the system...
Jan
5
comment Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?
@DeerHunter: If I've ever visited a spoofed Google domain that abused this certificate, Firefox would have displayed "Verified by: Turktrust" in the SSL popup, right?
Nov
6
comment Which security risks are associated with alternative DNS providers?
Moral of that story: don't install root certificates if you're not really, really sure what you're doing?
Nov
5
comment Which security risks are associated with alternative DNS providers?
Expanding on that first point: this would only be the case on websites that already trigger a security warning in my browser, right? I haven't added any exceptions.
Oct
16
comment Google Account: implications of using application-specific passwords
Could you back this up with some references? That's not how I thought this worked.
Oct
5
comment Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?
@Ramhound: are the costs for such a certificate relative to the size of their business? If not, I'd assume that the cost of such a certificate is only a drop in the bucket for them.
Oct
5
comment Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?
It's not like they don't have the money to go through the additional hassle of getting an extended validity certificate. It might stop people like me from being worried if they see '(unknown)'.
Oct
4
comment Firefox lists '(unknown)' as the owner of google.com. Is my connection insecure?
Google, one of the world's biggest tech companies, doesn't have one? That's weird. Some other well-known sites like PayPal do have them.
Oct
3
comment Can a VPN decrypt my SSL traffic?
Well, it's not always clear whether a hostile source is involved. I'm no security expert, so I cannot screen software-dependent VPN providers. I can see if they list a physical address, look up what security experts are saying about them and check that their installers carry a valid certificate that was issued by a trusted provider. But are services like Hotspot Shield, HideMyAss or Witopia hostile? I wouldn't know. I can't analyze every registry change, every network packet they send/receive and so forth. I don't have the time, patience and knowhow.
Oct
2
comment Can a VPN decrypt my SSL traffic?
Is there a way to find out if I have any malicious root certificates on my computer? This might be helpful when using VPNs that require a software install.
Aug
22
comment Security implications of using a OAuth-enabled password manager
2-factor auth requires that the hacker has physical access to the Google Authenticator application on my smartphone. Why wouldn't that make my account more secure?
Aug
22
comment Security implications of using a OAuth-enabled password manager
You're talking about Mat Honan, right? From what I gathered they got in by compromising the secondary e-mail address (his @me.com account) that he had configured on his Google account. I enabled Google Authenticator as an additional layer of security and I don't have a secondary e-mail address on file.
Aug
22
comment Security implications of using a OAuth-enabled password manager
2) I assume you mean using a regular password manager that holds my Google pass. An offline password manager is more susceptible to bruteforce attacks whereas Google can limit the amount of failed login attempts and notify me of suspicious behavior. Besides, Google's 2-factor auth is more secure than merely having a password. 3) Browser exploits, plugin exploits, malware disguised as a useful piece of software and antivirus oversights may all help them to get access to my computer.
Aug
22
comment Security implications of using a OAuth-enabled password manager
Benefit: I won't have to remember a master password. Benefit: to gain access to a password reset-enabled account a hacker currently has to compromise my Google account. If I use the password manager and a hacker tries to get into that account by breaking in to the password manager, they still need to compromise my Google account to get that password. Benefit: Google's OAuth servers might have better protection against force attempts than an offline password manager.
Aug
14
comment Google Account: implications of using application-specific passwords
@Ramhound: "there is no reasonable way Google could implement something like this" They can. They could let me configure permissions to access certain services (Gmail, Calendar, Docs, etc.) per app-specific pass. They could also revoke the pass if someone uses it on a different ISP halfway across the world.
Aug
13
comment Google Account: implications of using application-specific passwords
So if Google set up suspicious activity detection and/or allowed me to configure the permissions (e.g. Gmail, Google Contacts, Google Calendar, etc.) for each app-specific password, the only issue with this system would be fixed?
Aug
13
comment Google Account: implications of using application-specific passwords
Offline bruteforcing would require physical access to the device. Without 2-factor auth you need to reset your password in this case. With 2-factor auth you can revoke the app-specific password and keep your current pass.