Reputation
33,577
Next tag badge:
600/400 score
77/80 answers
Badges
2 38 88
Newest
 Good Answer
Impact
~2.1m people reached

Oct
4
comment Storing KeePass database in cloud. How safe?
@erm3nda it is true you don't control someone else's system, but you also don't fully control your own. It is a false statement to say security only exists on local host. Your pen drive is susceptible to being lost or stolen. There are sla based providers with security guarantees that let you know what they are doing. You still want to have your own protective measures (line storing the data after encrypting client side) but in some situations a third party is in a better position to fill certain security elements more securely for less cost and effort.
Sep
18
awarded  Nice Answer
Sep
5
comment How do I safely inspect a suspicious email attachment?
@SargeBorsch indeed, however the odds of that happening on any particular questionable file are pretty darn near zero unless someone is being specifically targeted. I updated to expand on the possibility though, as it is possible, even if unlikely.
Sep
5
revised How do I safely inspect a suspicious email attachment?
added 339 characters in body
Aug
30
awarded  Yearling
Aug
8
comment Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?
@danielAzuelos um, no. There is no need to be convert with monitoring or be able to make it look like a bug. If you control the hardware you can add any kind of secure tracking that you want without need of fancy back doors that would evade detection. They just need to be setup so you can't evade them period. Further, you can't have something "well authenticated" and "looks like a bug". Nobody is going to look at a decompile and go "hey, that looks like a crytographic verification that allows an exploitable bug, must totally not be there intentionally."
Jul
27
awarded  Constituent
Jul
21
comment Can you protect corporate email on personal phones without the option of wiping all personal data?
Yes, that is now an option as is the exchange native app. Both are new since my original post I believe, but thanks for posting an update.
Jul
20
awarded  Caucus
Jul
1
comment Are photographs of fingerprints a security risk?
Finally, if you have physical access, there are far simpler and cheaper ways to access a fingerprint than the mentioned photographic technique, so it isn't really any additional risk.
Jul
1
comment Are photographs of fingerprints a security risk?
This answer is accurate that high resolution images will allow for duplication of a fingerprint, but I think it misses the core point of the question. HD cameras (which aren't actually that high quality) aren't going to allow for reproducing a fingerprint remotely, or even with it as the intent. Yes, a high resolution still camera can capture high enough quality images, but without physical proximity, people are not going to post purpose taken high quality images of people's fingers online generally, so there is a lack of suitable public material in most cases.
Jul
1
comment Are photographs of fingerprints a security risk?
@GroundZero HD cameras don't pose a risk, high quality photos at close range do. There is a major difference between the two. I simply pointed out that other approaches are more practical as a highlight of the fact that pointing out high resolution photos as an alternative to HD video doesn't really matter as other options are cheaper and easier if you have proximity. My read of the original question was more that it dealt with publicly available imagery, which is not going to be a specifically high res image of a finger.
Jul
1
comment Are photographs of fingerprints a security risk?
@GroundZero - yes, however if you look at the photos they are using, they are close up photos. Certainly photos are more likely to allow for this than video, but the original though of video isn't viable, and it would take some amount of equipment and effort to capture the photographs of a subject's fingers. It would be far easier and cheaper to simply dust something they touched.
May
15
comment Security of several files all using same password/key (7zip, AES256)
More specifically, in a real worst case scenario, the chaining mode won't matter. Chaining only means that the current state depends on the previous iterations of the algorithm. If the first phrase of the encryption is able to be broken, then any subsequent ones could still be broken though and the IV is going to be known since the IV is not protected data. It is the job of the algorithm to ensure that you can't figure out the key from a set of plaintext and cipher text.
May
15
comment Security of several files all using same password/key (7zip, AES256)
@Ángel- um, no... what you describe is a KPA (known plaintext attack). There currently isn't any major KPA against AES (at least not that I've heard of). There are stronger and weaker block modes for other attacks, but you are talking specifically about KPAs and drastically failing KPAs, of which there are none for AES currently.
May
14
comment Security of several files all using same password/key (7zip, AES256)
@angle - If knowing the plaintext and ciphertext gives away the key, your algorithm is SERIOUSLY broken. Note that I specifically indicated that my answer is only relevant if the key selection and encryption algorithm is strong.
May
6
awarded  Nice Answer
Apr
11
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Rushyo - are you saying that Comodo actually gave cloudflare access to their root pki keys? That would be very bad and would be worth stopping trusting them. (Other CAs have been delisted for compromise of the private keys.) Much more likely would be that they signed a code signing key for Cloudflare and you could simply decert the specific delegated key to break chain of trust. IT wouldn't block 90% of the internet, it would only break the certs that Cloudflare generates.
Apr
10
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Rushyo - in the case of a load balancer, it should be load balancing across either a physically secure network or should be re-encrypting to the end point. The problem is only when you label something as a secure connection that is not. Providing an SSL gateway to a non-encrypted site across the open internet is a very different thing from providing a load balancer in a secure data center that acts as the SSL head.
Apr
9
awarded  man-in-the-middle