31,878 reputation
23379
bio website
location Rensselaer, NY
age 30
visits member for 2 years, 7 months
seen Mar 23 at 13:49

Feb
22
comment Create certificate without private key with OpenSSL
Can't you use the smart card to sign the CSR? Simply produce the unsigned CSR and then submit it to the card for signing. Signing is typically a feature of a smart card since without being able to sign, it can't prove to anything that it has the private key.
Feb
15
comment Why don't mobile operators blacklist stolen phones using their IMEI?
Fair enough, but a permanent fix still isn't a concern for a thief. They just want to get the cash. They are almost never the end user, because they know having stolen property is a bad idea.
Feb
15
comment Why don't mobile operators blacklist stolen phones using their IMEI?
I'm not sure if it is possible to clone with a jtag or similar device against the hardware directly, but a thief doesn't care if it works long term. They care if they can pawn it off on someone before it breaks.
Feb
14
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
@chao it is worth pointing out that using crypto all the time doesn't hide that you sent a message, it just hides if it is interesting. Also, otp isn't limited to the Internet so it could be used through covert channels that are harder to track to you.
Feb
14
comment Why would an attacker try to guess random email usernames on a small domain?
@skaperen Actually there is zero chance because they try the same series of passwords and are blocked before they ever get to a valid password since the initial guesses don't meet complexity requirements.
Feb
14
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
@Hopelessn00b - Ok, re-reading your comment from earlier, I think I get what you are saying about OTP not maintaining perfect information security (sorry, it is 2am here). It does leak that you may have sent a message (but you may not have). But that in no way aids in breaking the cryptography itself. My statement is very clearly about being "impossible to break", not "impossible to make any observation about your action". There is no information leaked which is useful in breaking the cryptographic protection of the message.
Jan
4
comment Two-factor authentication Without Mobile Phone
@tepples that is why account name and login should not be the same if you can avoid it.
Dec
16
comment Is it possible to upgrade the SSL version of a connection from the server's side only?
Disabling SSL3.0 on the server should force it to use a non-default option (or the connection will just fail). It is probably your best bet for forcing it though.
Dec
13
comment SQL Injection solutions
@Scarl the safest is to parameterize your SQL, but if you can't do that for some reason, any input sent from the user's computer that is used in creating a SQL statement must be filtered.
Dec
11
comment Port Scan Detected and Blocked! - Bitdefender 2014
@user54791 that's assuming that the router is actually a NAT router and not just a basic network router. Depending on the type of router, it may just be putting them on the same network as his cable modem and his cable modem may just be handing direct IPs to each computer on the network.
Dec
8
comment generate certificate at runtime and validate
This is broken. Do not do this.
Dec
5
comment Since I can set the source IP address to anything using raw sockets, does this mean I am untraceable?
@Kevin - it isn't that large of a number of routers normally. It may travel through 10 to 15, but generally, at least 1/3 of those are on the ISP's network and another 1/3 or so on the recipient's ISP's network. The ones in between tend to be backbone networks, but they still care about entry and exit points on their network for traffic for billing and peering negotiations. They may or may not log every packet, but if they start noticing a weird pattern, they are likely to make note of it.
Dec
5
comment Does it matter which key is considered private and which public?
Can we add more clarification here about if this is talking specifically about RSA or about asymmetric crypto in general? It makes a huge and potentially catastrophic difference.
Dec
2
comment Do I have to hash users' IP addresses when I log them?
I would also add that storing the IPs in a "non-reversible" manner is counter productive as it prevents you from being able to track security threats against your site. If you don't have an accessible IP address in the log file, then you can't report relevant information in the case of an attack on your systems.
Nov
26
comment Are photographs of fingerprints a security risk?
@Josef - that's an interesting area of research, but it is still making some approximation guesses which could potentially throw off getting an accurate finger print reading. It would also have perspective issues to correct for and shaping issues in order to get a consistent finger print out of the video. It might be possible at some point in the future, but I'm still not particularly convinced that the state of the art could extract a usable print, at least for finger print systems with a low false positive rate. Other methods are certainly far easier to obtain prints.
Nov
24
comment Can a botnet be used to effectively break encryption keys?
@k1DBLITZ - when the times to crack are several orders of magnitude past the heat death of the universe, it doesn't practically matter. Every additional bit DOUBLES the time to crack, assuming there aren't flaws in the algorithm.
Nov
24
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@nowen - fair enough.
Nov
21
comment Encrypted retrievable password
@MatthewPeters - fair enough, happens to us all.
Nov
21
comment Encrypted retrievable password
@BustedSanta, does the decrypted password need to be available offline (ie, when the user isn't logged in)?
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - oohhh, that's YOUR product that you handily didn't disclose your affiliation with in the comment. Please tell me you are at least using a randomized GUI pin entry that doesn't link to key press events so that it is protected against basic loggers. (Which would be the reason I put the (almost) in the above comment.) Otherwise, the feature is completely worthless (and actually a hindrance to users).