Reputation
9,249
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
2 16 59
Newest
 Good Answer
Impact
~509k people reached

Apr
11
revised Exploiting HTTP content in HTTPS page
Updated and clarified
Apr
10
reviewed Approve How to explain Heartbleed without technical terms?
Apr
9
answered Is Apache serving over HTTP vulnerable to Heartbleed?
Apr
9
comment Are there any known Heartbleed attacks?
Nice try, FBI. No but seriously, I don't think the kind of people that go around trying to exploit the internet are going to visit this site and tell you about it.
Apr
8
reviewed Approve Are there any known Heartbleed attacks?
Apr
7
reviewed Reject What methods can be used to prevent mistyped usernames?
Apr
6
comment Why are apps for mobile devices more restrictive than for desktop?
First thought: Because they were designed far more recently with more modern needs in mind, and desktop OSes have yet to catch up.
Apr
5
comment Is Telegram secure?
@TerryChia I understand your point, and I too distrust any crypto in new apps, but I don't think this is the major concern when using Telegram right now. The protocol has been looked at by a few smart people and so far I've yet to hear actual issues, so that in my opinion that moves it from "distrusted" to "probably one of the lesser issues". Things like not having plausible deniability, leaking metadata, devices being pwned, people not comparing the encryption key out of band, etc. seem like much bigger issues when deciding whether one should say product X can be ultimately trusted.
Apr
5
comment Is Telegram secure?
In short, I'd say nothing is secure that works as easy as Telegram, WhatsApp, Skype, BlackBerry, etc. All of those (except WhatsApp) have promised end to end encryption, and so far only Telegram is not known to hand over their encryption keys to governments, simply because they are not big enough yet. Somehow Microsoft and Blackberry made it possible to break their own security and provide India and the United Arab Emirates with some plaintext. I wouldn't put it past any app to do this. For real security, use trusted tools like PGP/GPG or OTR.
Apr
5
comment Is Telegram secure?
Reiterates lots of the criticism, but so far I have yet to hear a non-theoretical vulnerability. Can anyone read encrypted messages as they go over the wire, change contents without the other party noticing (even if the attacker doesn't know what the decrypted output will be), or spoof the sender? If not, I don't see a problem with this self-designed protocol. All protocols have been designed by one team or another at some point.
Apr
4
reviewed Approve How does a country block its citizens from accessing a site?
Apr
3
comment Security of a Windows XP system after April 8th when running the latest Firefox or Chrome
"XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains." I understand that, but you'll need to somehow reach the system to exploit it. So if the browser is the only way, and it's a modern and up-to-date browser... That's what I'm asking about. "an installation of linux" I've thought of that, but Windows 8 on her work laptop is a huge change already. I'll use this as a last resort. Thanks for the suggestion though!
Apr
3
comment Security of a Windows XP system after April 8th when running the latest Firefox or Chrome
Third party anti-virus already installed for the same reason as a third-party browser. EMET may be a good idea though, thanks!
Apr
2
asked Security of a Windows XP system after April 8th when running the latest Firefox or Chrome
Mar
31
reviewed Approve Do non-keyboard characters make my password less susceptible to brute forcing?
Mar
28
reviewed Approve How do I use a TPM to protect my BIOS/EFI from “remote” attacks
Mar
27
reviewed Approve wcf tag wiki excerpt
Mar
26
reviewed Reject Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
Mar
24
reviewed Approve Malicious code in image. Harmful?
Mar
24
reviewed Approve Getting exploit reliability when using the off by one framepointer overwrite on linux