Reputation
788
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 13
Newest
 Revival
Impact
~70k people reached

9h
comment Could keystroke timing improve security on a password?
For that matter, I have different mouse/keyboard combinations for the same device (laptop). When I'm traveling, I use a mini-keyboard, or even the one that's molded into the laptop, when I'm at my desk at work, I have a different keyboard/mouse set than I do at home, etc. The timing on my keystrokes varies wildly according to that, in addition to time of day (caffeine/tired) and gawd only knows what else. Keystroke dynamics are just a fundamentally poor choice for a security feature.
9h
comment Could keystroke timing improve security on a password?
The idea is that an individual types certain keys in a certain way that does not change much over time. Anyone who thinks this hasn't watched anyone work before their morning cup of caffeine. Sounds like a great way to get someone to smash their computer into a smoldering pile with their coffee cup to me.
Apr
18
comment Are there more hacks done by social engineering, etc, than breaking the software system?
Only amateurs attack machines; professionals target people. -- Bruce Schneier This is because your defense is only as strong as its weakest point, and that weakest point is almost always going to be a person. Having said that, your question's too broad to answer. Define "hack". Is it a hack when a jealous lover tries to access his/her partner's Facebook account or smartphone? And then how would you go about collecting data on hacks or attempted hacks? Most aren't even noticed, let alone reported, so any stats you do get would have a massive hole and bias built into them.
Mar
3
comment How does an attack on a digital signature work?
The attack here is simple, it is called "lying". I actually loled there, thank you.
Feb
23
comment Why hasn't anyone taken over Tor yet?
@a20 Well, almost correct. We actually do know that the NSA gets involved with (or did get involved with) using their spying powers against run-of-the-mill criminals. See "Parallel Reconstruction". What's a bunch of perjury and constitutional desecration between federal agencies, right? :/
Feb
22
comment Online shops SSL certificates and VISA/MasterCard
@Rambalac It's international. The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle branded credit cards from the major card schemes including Visa, MasterCard, American Express, Discover, and JCB. If you want to process their credit cards, you'll be held tp PCI DSS for determining liability of fraudulent charges, regardless of which country you're in.
Feb
21
comment What are the potential privacy issues in using a TPM chip with GNU/Linux
@NeilSmithline Assuming he knows what he's doing, he's probably looking into buying something like this. Yup, add-on TPM chips are a thing.
Feb
20
comment What happened to US-CERT Weekly Vulnerability Bulletins?
@RoraΖ Yurp. We are resolving issues affecting our weekly security bulletins, but hope to resume posting them soon.
Feb
19
comment Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?
@Robin Well... yes, I suppose that would probably work. But moving and/or changing the file extensions of all the files you want to prevent from being encrypted seems like a lot more work than ... well, for lack of a better phrasing ... "doing it right."
Feb
19
comment Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt?
Probably helpful, related question.
Feb
19
comment Securely enable FBI backdoor for phones
I'm going to make a very general statement to avoid getting political, so don't take offense, but... those "criminals" you don't want to be able to keep their data from law enforcement? You're one of them. (And so am I, and so is every other American adult.) At least you're in good company, I guess. In keeping with trying to avoid getting political, I will cite the example of a federal law that was mercifully struck down for being so broadly worded as to make it a federal criminal offense to browse the web or perform anything personal while "on company time."
Feb
19
comment Securely enable FBI backdoor for phones
Also, fusion centers. So, not just other countries, but also just about every state and local law enforcement agency in this country, too. I can't help but think that eventually they'll get bored of shooting unarmed people in the back... I don't want them to move on to poking around through my personal, private data for a change of pace.
Feb
19
comment Apple's open letter - they can't or won't backdoor iOS?
However, once the precedent has been established that Apple can be legally compelled to create an encryption-crippled iOS (or code to the same effect) in this one case, that precedent can be used to compel the same thing in EVERY future case. This is at least as much a fight over what Apple can be legally compelled to do as what it is technically capable of doing.
Dec
3
comment How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?
This is what we did at the last two places I was the [only] "IT guy." We then put all those credentials and the like onto two USB sticks, encrypted them with a password the owner/CEO chose, and stuck one in the safe in his office, and the other in the fire-proof safe we used for our archival backups.
Oct
30
comment Can my IT department read my Google Hangouts chats while at work?
@Kristopher Sure, that's why I said the more applicable question was whether the IT department cares. I don't. Other people/jackass control freaks might.
Oct
20
comment Is there any way to safely examine the contents of a USB memory stick?
@Shane Oh, they got over a year's worth of warnings. And instructions on which networks they could plug potentially infected USB devices in. And company issued equipment so they wouldn't need to use the kiosk. Us IT folks were long fed up with cleaning up after and it and screaming for blood long before they got canned... but, eventually, one of the infections inconvenienced or embarrassed one of our C-levels, and that was that.
Oct
19
comment Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer?
@Begueradj I was a moderator on ServerFault. While I was, no one bothered us enough to check things like that out of band.
Oct
19
comment Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer?
(after suspicion of bad behaviors a user may perform) they analyse the way how you write. No, Stack Exchange does not do that, and tools moderators have access to via Stack Exchange are... not cutting edge, by any means. Yes, there are a number of ways to id a person based on their writing styles, but Stack Exchange does not have such an interface for their moderators.
Oct
19
comment Is there any way to safely examine the contents of a USB memory stick?
what measures do/can photo-printing kiosks take to guard against these kinds of attacks? None. They just let themselves get compromised. When I worked for a major A/V vendor, one of our offices was in the same building as a pharmacy, and we ended up having to fire a few employees for continuing to use the photo printer in the pharmacy, because the USB devices they plugged into the photo kiosks would be infected by dozens of different pieces of malware, and those would get onto our internal network when they plugged the USB device into their work machines.
Sep
16
comment Ipsec Native VPN on Windows 8 or 10
@user2641043 RADIUS (the NPS server role in Windows) is generally the go-to authentication method for network gear needing to authenticate Windows domain users or machines. I also know for a fact that it's possible to have an IPSec/L2TP VPN that doesn't ask for or use that "group name" field (as this is the type of VPN I've had access to at work for the last several jobs), but being a systems guy more than a network guy, I don't recall how to go about doing that (maybe that's one of the effects of using RADIUS authentication instead of authing against the network device, for all I know).