31,988 reputation
23482
bio website
location Rensselaer, NY
age 30
visits member for 2 years, 7 months
seen 2 days ago

Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - oohhh, that's YOUR product that you handily didn't disclose your affiliation with in the comment. Please tell me you are at least using a randomized GUI pin entry that doesn't link to key press events so that it is protected against basic loggers. (Which would be the reason I put the (almost) in the above comment.) Otherwise, the feature is completely worthless (and actually a hindrance to users).
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - which would still be entered on a compromised device and thus provide 0 to almost 0 additional security. It only prevents a non-persistent remote exploit of the device, which is a very, very small use case of protection. More thoroughly, it only helps you when there isn't key logging on the device, in which case the password for the site wouldn't be compromised and the 2FA token compromise wouldn't matter. There is literally almost no situation (if any) that WiKID's password on the token helps anything.
Nov
21
answered Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
Nov
20
reviewed Close Protected excel sheet is unprotected without permission in google spreadsheet
Nov
20
reviewed Close Should one worry about using an outdated version of Firefox?
Nov
20
reviewed Close Advice on if I should talk at my local user group about NIST, InfoSec etc
Nov
20
reviewed Close bscrypt,scrypt v/s iterative SHA-x
Nov
19
revised storage of client credential on OAuth2 server
added 404 characters in body
Nov
19
answered storage of client credential on OAuth2 server
Nov
18
reviewed Close Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat?
Nov
18
reviewed Close Old e-mail text types itself back into PC later by itself?
Nov
18
reviewed Reject Best practice in web application security authentication to avoid bruteforce attack
Nov
17
comment Question regarding SSL / TLS / Certificates in general
Adding some clarification for you. Yes, check the main How does SSL/TLS work, but the AES identifies the actual symmetric key used, but that is established by a key exchange which occurs using the certificate. The certificate is what you were making in openssl.
Nov
17
comment Is it possible that authorities can't block a certain website
It wouldn't even be possible to tell who watched it if the stream is encrypted. Multicast streaming doesn't work over the open internet and I don't think TOR has support for it either, so you would need to establish a unique connection for each viewer and the encryption would make it impossible to checksum to identify content. You could possibly length match, but some basic padding on the stream would destroy that.
Nov
14
reviewed Close Can I ever hope to be secure using a cell phone or any mobile device?
Nov
14
reviewed Close Finding Plaintext Password Repositories
Nov
14
reviewed Leave Open Hardware-based full disk encryption without pre-boot authentication
Nov
13
reviewed Close Proper way to allow access to systems within different offices?
Nov
13
reviewed Close RSS Feed Security warnings
Nov
12
reviewed Close Browser page “Not resolved” page hijacked by yandex