30,494 reputation
23277
bio website
location Troy, NY
age 30
visits member for 2 years, 3 months
seen 17 hours ago

Nov
6
answered How different should my passwords be?
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. - ok, that looks like the ID of the phone itself. Note that you can deactivate, delete or change the label, you can't actually change the UUID. I wouldn't count on that for any security as it is shared by the device like candy if it is the number I think it is.
Nov
6
comment Key Management/storage system
Well that's unfortunate... I added a later paragraph with some ideas, but it's less than ideal.
Nov
6
revised Key Management/storage system
added 950 characters in body
Nov
6
comment What are the weaknesses of my authentication scheme?
though, of course, there isn't much alternative in the case of a phone.
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. ah, I think I misunderstood what you meant by the UUID of the phone. On Android smartphones, there is a UUID used to identify the phone. If this is a UUID that is generated by lastpass and stored on the phone, that's a bit more secure, though at that point, using an asymmetric key pair would be a far better practice as the OS would also much better protect the private key. Note, it is also somewhat limited usefulness in terms of "what you have" if the "what you have" is directly tied to your client since it doesn't help protect against a compromised client...
Nov
6
answered Key Management/storage system
Nov
6
comment How to locate a Windows application's hard-coded GUID from a hex dump
Fair enough, still not seeing anything about this security related though. Even if you need it to be the same for some security purpose, this falls under technical implementation methods which aren't generally on topic here, but rather on the site most related to implementing it (ie, StackOverflow in this case)
Nov
6
answered What are the weaknesses of my authentication scheme?
Nov
6
answered Wifi - Can you be traced?
Nov
6
comment Buffer overflow without using environment variables
We don't need to know an address. We need to know an offset. The structures of how a program loads in to memory are generally consistent, so you would just make a payload that is oversized by enough to be able to push in to some control flow in memory and then hijack it to jump wherever we want. It's not the simplest thing to do in practice, which is why not every overflow can be easily exploited, but the basic principal isn't that complicated.
Nov
5
revised Buffer overflow without using environment variables
added 449 characters in body
Nov
5
answered Buffer overflow without using environment variables
Nov
5
reviewed Reopen Why does integrity exclude confidentiality?
Nov
5
reviewed Leave Open How secure are encrypted USB sticks really?
Nov
5
reviewed Close how to get mysql user password?
Nov
5
answered Modifying credit cards to increase security
Nov
5
revised Modifying credit cards to increase security
added 3 characters in body
Nov
5
answered How secure are encrypted USB sticks really?
Nov
4
answered What would HTTP/2 TLS encryption provide?