Reputation
510
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 12
Impact
~60k people reached

Dec
3
comment How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?
This is what we did at the last two places I was the [only] "IT guy." We then put all those credentials and the like onto two USB sticks, encrypted them with a password the owner/CEO chose, and stuck one in the safe in his office, and the other in the fire-proof safe we used for our archival backups.
Oct
30
comment Can my IT department read my Google Hangouts chats while at work?
@Kristopher Sure, that's why I said the more applicable question was whether the IT department cares. I don't. Other people/jackass control freaks might.
Oct
20
comment Is there any way to safely examine the contents of a USB memory stick?
@Shane Oh, they got over a year's worth of warnings. And instructions on which networks they could plug potentially infected USB devices in. And company issued equipment so they wouldn't need to use the kiosk. Us IT folks were long fed up with cleaning up after and it and screaming for blood long before they got canned... but, eventually, one of the infections inconvenienced or embarrassed one of our C-levels, and that was that.
Oct
19
comment Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer?
@Begueradj I was a moderator on ServerFault. While I was, no one bothered us enough to check things like that out of band.
Oct
19
comment Can a website identify me if I go in privacy mode with a different IP ? Or should I use a different computer?
(after suspicion of bad behaviors a user may perform) they analyse the way how you write. No, Stack Exchange does not do that, and tools moderators have access to via Stack Exchange are... not cutting edge, by any means. Yes, there are a number of ways to id a person based on their writing styles, but Stack Exchange does not have such an interface for their moderators.
Oct
19
comment Is there any way to safely examine the contents of a USB memory stick?
what measures do/can photo-printing kiosks take to guard against these kinds of attacks? None. They just let themselves get compromised. When I worked for a major A/V vendor, one of our offices was in the same building as a pharmacy, and we ended up having to fire a few employees for continuing to use the photo printer in the pharmacy, because the USB devices they plugged into the photo kiosks would be infected by dozens of different pieces of malware, and those would get onto our internal network when they plugged the USB device into their work machines.
Sep
16
comment Ipsec Native VPN on Windows 8 or 10
@user2641043 RADIUS (the NPS server role in Windows) is generally the go-to authentication method for network gear needing to authenticate Windows domain users or machines. I also know for a fact that it's possible to have an IPSec/L2TP VPN that doesn't ask for or use that "group name" field (as this is the type of VPN I've had access to at work for the last several jobs), but being a systems guy more than a network guy, I don't recall how to go about doing that (maybe that's one of the effects of using RADIUS authentication instead of authing against the network device, for all I know).
Feb
14
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
Oh, yes, there you go... that's what I was trying to get at. Not having perfect information security means that even the protection of perfect crypto won't perfectly protect your information, so even without breaking the crypto, some information can be gleaned. For some reason, I inferred an implication in your post that wasn't there about a properly implemented OTP equating to perfect information security.
Feb
12
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
@MSalters And there are already effective attacks (plural, two that I know of off the top of my head) against quantum entanglement (or at the very least, existing crypto systems using quantum entanglement). So that's not a solution either.
Nov
24
comment What makes it difficult to have a hardware antivirus?
The thing that makes computers so useful is that they are inherently instructable. We can program them to do a truly staggering number of things. Of course, the downside of that is that other people can program them to do things we don't want them to do too, and it's not like there's an easy way, or any universal way to decide which programs are bad, and which aren't. I mean, spyware's bad, right? Oh, except it's also used by employers to keep an eye on their employees, and parents to watch their kids online. Anything you do to make computers less programmable makes them less useful.
Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
Wow, your boss must love you. I, myself, find the urge to hire you almost overwhelming.
Mar
28
comment How do big companies and wealthy people secure their information? And how can I secure mine?
And also, how do large corporations and VIP (billionaires, celebrities, heads of state) individuals secure their passwords? They... don't. Worked for a guy once, owned a decent sized company (and a bunch of smaller ones), with a personal worth of mid-nine figures, and his password for everything was bob. Three guesses what his first name was. Assuming that the rich and powerful actually do security right is a very dangerous assumption. Focus instead on how to do it right, and ignore the mind-numbingly foolish practices of the rich and famous.
Mar
12
comment Is it possible to boot an encrypted server remotely and securely?
No one mentioned out of band management. iLO, iDRAC, etc. Weird.
Feb
21
comment A service that claims beyond army level encryption
<shrug> Achieving "beyond [insert government agency] encryption" is pretty trivial. I use Truecrypt, and use a triple cascade of 256 bit ciphers to protect my data. To my knowledge, no government agency anywhere has an encryption standard that stringent, so anyone with access to a free encryption program can achieve "beyond [insert government agency] encryption" by clicking through a wizard. Doesn't actually mean that data's more secure than the army's, though. Just product marketing to make their service sound impressive and attract customers.
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
it used to. I would suggest that if the copy of Windows you're using doesn't let you input an invalidly long length for your pings, it may be a patched version. See if you can find one that lets you enter in an invalidly long length... more likely to be vulnerable.
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
Can you try sending between Windows 95 VMs? I know that in Windows 95 it was as simple as ping -l 65510 [victim]. I also remember this trick having mixed results on Windows 95 and NT 3.5 - some systems would crash, some wouldn't, and there didn't seem to be much rhyme nor reason to why one system was invulnerable, and another wasn't. (So, maybe you're not doing anything wrong and your VM's just not vulnerable to the PoD.)
Feb
20
comment Is it possible to hack my encrypted session and hijack the session by electromagnetic waves?
Frankly, you should be much more worried about other attack vectors (as stated at the end of my answer), but if you feel like making #2 and #4 more comprehensible, so that I can understand what you're asking, I'd be willing to update my answer to attempt to answer them.
May
30
comment Can unencrypted keys & logins be kept out of program memory?
Additionally, Homomorphic Encrpytion might be of some interest to you.
May
30
comment Do keyfiles actually add any meaningful security in the presence of strong passwords?
@Adnan Yeah, I did read that question you linked when searching for an answer to this, but it seems to me like keyfiles as "something you have" don't serve that function any better than a second password - generate and record a random, maximum-character-length password (or put it into a YubiKey), store it offline, and... you've created a keyfile without using keyfiles. Right?
Sep
23
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
Thanks. Good advice. I should just get the data I'm responsible for to a more secure location and move on. It will probably be on the media and courts to handle soon enough anyway.