Reputation
512
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 13
Newest
 Curious
Impact
~32k people reached

  • 0 posts edited
  • 1 helpful flag
  • 133 votes cast
2d
comment How do I safely inspect a potentially malicious website?
@JanDvorak : And this is why WOT has lately more and more false positives, as users flag sites as malicious solely based on ideological grounds. Blogs, sites of politicians or political parties, many religious or philosophical sites, they are all filled with ideologically motivated red flags.
Apr
20
awarded  Curious
Apr
19
accepted Are services who offer to pay you a rent for your unused hard disk space a scam, and how do they work?
Apr
19
asked Are services who offer to pay you a rent for your unused hard disk space a scam, and how do they work?
Apr
15
accepted How to handle root passwords for a number of embedded linux boxes?
Apr
14
comment How to handle root passwords for a number of embedded linux boxes?
@symcbean : Yes, for example I could put only the privilege-requiring parts into a separate program and add it to the sudoers list, or use setuid and give its ownership to root, but that would add a communications overhead between it and the main application. I'm still considering whether the possible risks are worth the overhead.
Apr
14
comment How to handle root passwords for a number of embedded linux boxes?
@SmokeDispenser : In that case, if this community thinks that just disabling the root login and remote login would be sufficient, and having the same root password on every device doesn't have any serious vulnerabilities I forgot to think about (and that this is common practice), I could accept a slightly expanded version of your comment as an answer.
Apr
14
asked How to handle root passwords for a number of embedded linux boxes?
Apr
12
comment How should I tell school that they are vulnerable when I wasn't given permission to check?
Can this vulnerability be stumbled upon "accidentally" while doing an assignment or class in the computer lab, or does it take active effort to exploit?
Jan
19
answered How should I securely type a password in front of a lot of people?
Jan
18
comment Fake users in database for compromise detection
It seems many major sites already do this with real users, by using some heuristics to predict whether an account was compromised. I travel a lot, and when I log in from a different country than last time, may sites I use go into panic mode and require additional confirmation through e-mail or phone that it's really me who just successfully logged in.
Jan
14
comment Why do some internet banks force logout on back button?
This reminds me of an annoying bug on a major bank's website: when I intend to transfer money, they provide a last chance to view all the information before clinking the final commitment button. I reviewed it, found that I made a typo in the description field, clicked on the back button inside the website (so not the browser's back button), made my correction, then did this once again.... and was greeted by a message saying that I entered my SMS code wrong 3 times in a row so my account was blocked.
Dec
23
comment How to store passwords written on a physical notebook?
I have the advantage of having a relatively obscure native language, and on top of that I know and old script for it which fell out of use during the Middle Ages, and is known by significantly less than 1% of native speakers. So unless someone shares the same heritage and is a huge history nerd, they won't even recognize what the script and language are. Of course, if it was a targeted attack (if I was a celebrity, or an important CEO or political leader) they would figure it out, but otherwise it's a great solution against losing the notebook and especially casual glances by random people.
Dec
2
comment Is obfuscation worth it
"the attacker will always win" - if the attacker has unlimited time and money, then yes. Otherwise, it comes down to the question whether whatever the attacker might gain is worth more than the required effort or not.
Oct
23
awarded  Yearling
Oct
22
awarded  Citizen Patrol
Oct
22
asked If two programs on the same machine communicate through TCP, can it be seen from the outside?
Oct
10
revised How to prevent a prophecy from becoming self-fulfilling or self-defeating
added 2 characters in body
Oct
10
comment How to prevent a prophecy from becoming self-fulfilling or self-defeating
@Philipp : if something is unsuitable for one task, doesn't necessarily mean it's unsuitable for a completely different task. MD5 is still perfect for checking against non-malicious corruption of a file due to errors in transmission, for example. And I can't imagine how someone can write an on-topic text file with no gibberish in it, to have a pre-defined MD5 hash.
Oct
10
awarded  Scholar