22,926 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 1 hour ago

Apr
14
comment Are there “secure” languages?
@kutschkem - yes, but MANAGED type safe languages do. Managed code requires something to do the managing. By the way, I'm also not speaking against managed languages at all. I'm a C# developer.
Apr
7
comment How dangerous might be publishing a public key?
@nikolasasteri - while an accurate statement, I'm not sure I see the relevance here. This question wasn't asking anything about how to encrypt data using asymmetric keys, just if it was safe to share the public key.
Apr
7
comment Is PCI Compliance mandatory?
It isn't just if you are processing and storing. Simply handling the data is sufficient to require compliance.
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
Hmm, I do agree that that second line is suggesting getting a signed cert. My guess is that it isn't actually necessary and that they don't know how to do a trust check. I'd personally probably try to find a different library. That one seems rather limited and may have other flaws.
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
I don't see anything in that article you linked that indicates they are using a signed certificate. A self-signed certificate is perfectly valid, it just isn't trusted. The second paragraph seems to indicate this to be the case. It is also possible they did their own SSL implementation and didn't bother to hook in to the trusted root certificates on the device.
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
No problem, sorry it took such a long exchange to figure out what you were asking.
Apr
4
comment Server side SSH keys compromised
The MITM won't be able to decrypt the real server's portion of the key exchange, so it can't complete the connection with the real server since you need to know both the portion of the session key you generate and the portion of the key that the other system generates and the attacker has no way to get the part the real server generated without the client's private key.
Apr
4
comment Server side SSH keys compromised
@KarolBabioch - to further clarify on the client certificate part (since you don't seem to have understood it from either my answer or Thomas') When using client certificates, the client has a private key that corresponds to the public key given to the server. Unless the MITM is able to intercept the very first time that the client authenticates with the server, the server will already know the public key that corresponds with the client.
Apr
4
comment Server side SSH keys compromised
@KarolBabioch - I am saying the same thing as Thomas. An attacker with a private key of the server can not passively attack an existing connection between a client and the real server. (In other words, if the client connects to the correct server when initiating the session, then the false server can't monitor that connection or interrupt it because they don't have the session key.) The client certificate matters because the server will recognize if the client certificate is valid for the user being accessed. The MITM would need to be able to respond to the server's challenge for the user.
Mar
31
comment Best practices for handling computer viruses
@LB2 - if you don't mind the virus possibly surviving, then trying to clear it out is an option. I admit I've done this before on one or two situations, but I'm also a software developer and knew a fair bit about the kind of thing I was dealing with. It was a time consuming and difficult process even with my experience and wouldn't really be within the realm of possibility for most users. Rebuilding my computer takes weeks, so spending three days weeding out the tendrils was worth it for a basic infection, but for most people that isn't cost effective or even an option.
Mar
31
comment Best practices for handling computer viruses
@Lb2 - ah, yes, best practice is to only use a backup from prior to the initial infection.
Mar
31
comment How does LM hash deal with passwords that are between 8 and 13 chars
This question appears to be off-topic because it is about cryptography and really belongs on Cryptography.SE.
Mar
31
comment Best practices for handling computer viruses
@LB2 - this is why backups shouldn't be kept attached to the computer. A backup should be on an external drive. That said, it is far less likely that a particular virus knows how to hide in a particular type of backup file than it is that it knows some general mechanism of hiding on a complex system that you can't possibly hope to find it in.
Mar
27
comment SSL is Extended Validation more secure?
@Rob - the 3rd option is not just for banks. It is for anyone that wants to give their users the most possible trust that they are who they say they are. If your users are all going to know that your domain is actually your domain, you are probably fine with basic, however if you are going to have any walk-ins to your site, having further proven your identity will be beneficial.
Mar
25
comment Webpage sent me my password in clear text can it be secure?
Someone who occasionally comes around the site here actually runs Plain Text Offenders which attempts to shame such companies in to fixing their practices and explain to them the error of their ways.
Mar
24
comment SSL can stop MiTMs … but on the long run, can it really?
@nick - see my update (last two paragraphs), but you should really read up on one of the more general questions about how SSL works because your current understanding appears to be incorrect based on the question you are asking.
Mar
24
comment Is compiling source code from github a big security risk?
@JoanCharmant - as many as you want. ;)
Mar
24
comment What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things?
@BrandonSeet - but they can't. At least not easily. The whole point is that the chip never discloses the key that it stores. The memory that holds the key isn't accessible without dissolving protective layers on the card by just the right amount and directly analyzing the storage circuitry. Since the card is designed to be tamper proof, this is extremely difficult to do and not at all cost effective. The point is that cloning or altering the application on the chip or POS don't matter because you can't get the private key from the real card.
Mar
22
comment How does the authentication in the new UK £1 coin work?
@Clockwork-Muse - which brings up a valid point that really, the complexity of building all the pieces needed to make the coin is part of the key protection itself. You need a highly detailed mold that will match exact details, you need an unknown chemical composition, which if well designed, should be very hard to figure out how it is made even if you had a sample, you have alloys of material that probably follow similar protection. It's all really key management. The information you need to make a genuine coin is protected and split among different individuals.
Mar
21
comment How does the authentication in the new UK £1 coin work?
@Chloe - I doubt it, that wouldn't be a very good thing for something people handle. There is no reason it should need to be.