Reputation
33,517
Next tag badge:
600/400 score
77/80 answers
Badges
2 38 88
Newest
 Good Answer
Impact
~2.0m people reached

Jan
27
awarded  Good Answer
Jan
13
comment Why not allow spaces in a password?
@DanHenderson - indeed, the 4 word phrase is certainly more secure than just one word in terms of guessing. The risk is that most people will realize "teapot" isn't secure, but they might not realize that "I'm a little teapot short and stout" really isn't that much more secure. Giving someone the illusion of security can be very dangerous from a user's perspective. That said, I don't thing a "no space" policy does much to actually accomplish that, but it's literally the only reason I can think of that someone might try to limit it. Unfortunately ineffective but well meaning policy is common
Jan
13
comment Why not allow spaces in a password?
@PatrickM - I don't disagree it's probably a bad policy. However, if someone chooses a simple word, they know it is insecure. If they make a sentence they may think it is more secure without actually being significantly more secure. I suppose the hope would be that by not letting them be "clever" they might actually make a secure password, but that's really not a particularly good idea either since they could simply drop the spaces.
Jan
13
comment Why not allow spaces in a password?
@DanHenderson - No, your entropy calculations are incorrect because they are not randomly selected words. Meaningful sentences have a lot of structure which drastically reduces the actual entropy. Simply entropy calculations are only valid for truly random choices. For example, if you have "I'm a little ........" then there are much fewer than 250k words likely to fill that spot. Unless it's purely random, it isn't simple entropy. Also, like your last name... :)
Dec
17
comment Can I generate multiple PGP key pairs for later use
@PeterGreen - pre-creation and offline storage of multiple intermediate keys (or even a backup root key, though the root key should always be offline in this kind of case) may make sense in a PKI system where you need valid keys without a directory lookup, however you still have the aging problem, though it is less of a concern with offline keys. Additionally, for PGP specifically, it doesn't make a lot of sense to pre-generate keys as PGP generally uses online directories to access public key information for an individual, so pushing a new key is quick and simple.
Dec
16
comment What is the current best practice to secure an executive's laptop?
@tero the training has to be flexible. It isn't like you bolt him or her down for ten hours. Executives have time if it is important to them to do something. If they understand the importance of security, they'll make that time. If they don't, you are finished before you begin. Also, if a CxO making 3000 an hour is tied that closely to day to day operation, you are already pretty screwed up.
Dec
14
comment What is the current best practice to secure an executive's laptop?
@TeroLahtinen or, put another way, security only works "top down". If security isn't a priority for the people making decisions, it is never going to be effective. If it isn't a priority, they will work around whatever you try to do if it prevents them from doing something they want, but don't understand the risk. If the executives don't understand the risks, they CAN'T make good business decisions about security. They don't need to know implementation details or specifics of threats, but they do need to understand who is out to get them and have a basic understanding.
Dec
14
comment What is the current best practice to secure an executive's laptop?
And when you lose a 50 million dollar contact because the CxO got phished, the 30k or so training them would have cost looks pretty damn good. Nobody ever accused security of being cheap.
Nov
25
comment Avoiding MITM attacks when using HTTPS over mobile
@kouton those only apply if the attacker has control of your device. At that point ssl is irrelevant anyway. That white paper is more about legit uses of mitm ssl proxy and how to make specialized device configurations to allow monitoring of ssl connections. The general rule is that if someone has control of the device doing encryption and decryption, you can not be secure.
Nov
20
awarded  password-management
Oct
27
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
The fact remains that there is far more testing and analysis of protocols like ssl than anything you make up as your own suite. If your own stuff is layered on top of other stuff it may produce side channel attacks. The fact it has taken so long for issues to be discovered in ssl should be a confidence builder. It means even with a ton of eyes, vulnerabilities are hard to find. Additionally it means issues are found and announced by researchers that look in to this kind of thing.
Oct
27
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@h22 the home grown encryption doesn't just apply to algorithms or libraries, but also protocols. There are a lot of ways a password exchange can break down. For example, if you did client side encryption without a different challenge sent to the client every time, then the encryption would do nothing at all as it would only be obscuring the means of generating a password that would only be protected by ssl (since the client generated value would be the same all the time, making it the "real" password) There are all kinds of potential pitfalls, both obvious and non obvious.
Oct
27
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@h22 I suppose we can't be 100 percent sure, but if it isn't, passwords are the least of our concerns. Also, we're a heck of a lot more sure about TLS than we are about some home grown client side hashing or encryption setup. If say that falls under the "don't roll your own" practice.
Oct
21
awarded  Enlightened
Oct
21
awarded  Nice Answer
Oct
8
awarded  Nice Answer
Oct
5
revised Storing KeePass database in cloud. How safe?
add a bit about an offsite key
Oct
5
comment Storing KeePass database in cloud. How safe?
Since you were new to the site and were making a blanket statement like "security only exists on localhost" which isn't true in either the paranoid sense or the realistic sense of the term, I assumed that you may be mis-refering to the password db itself when you said "key file". I see now that was an error on my part, though clarification (which we've done now) is good to avoid others making the same mistake. Adi and I are saying the same thing. He mentioned a strong master password. I just went in to further explanation of why. I'll add a bit about using an actual local encryption key.
Oct
5
comment Storing KeePass database in cloud. How safe?
@erm3nda - I say "use something" simply because there are more than one valid way to separate the pieces you need and you can potentially split it up over multiple places as well. You could use a biometric protection, you could use a key you carry with you, you could carry the data with you but store the key offsite (less common, but prevents brute forcing of the data even being an option without compromising your person or a system you use). The important part is making multiple points of compromise required. Key file was ambiguous since we are talking about a password db...
Oct
5
comment Storing KeePass database in cloud. How safe?
@erm3nda ah, if you were simply suggesting that you should use something you keep with you to prevent decrypting the files stored online then I agree and think we are saying the same thing. There is a question of when it is enough for your needs, but that's a personal call.