30,419 reputation
23277
bio website
location Troy, NY
age 30
visits member for 2 years, 2 months
seen 1 hour ago

7h
comment Can a botnet be used to effectively break encryption keys?
@k1DBLITZ - when the times to crack are several orders of magnitude past the heat death of the universe, it doesn't practically matter. Every additional bit DOUBLES the time to crack, assuming there aren't flaws in the algorithm.
9h
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@nowen - fair enough.
Nov
21
comment Encrypted retrievable password
@MatthewPeters - fair enough, happens to us all.
Nov
21
comment Encrypted retrievable password
@BustedSanta, does the decrypted password need to be available offline (ie, when the user isn't logged in)?
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - oohhh, that's YOUR product that you handily didn't disclose your affiliation with in the comment. Please tell me you are at least using a randomized GUI pin entry that doesn't link to key press events so that it is protected against basic loggers. (Which would be the reason I put the (almost) in the above comment.) Otherwise, the feature is completely worthless (and actually a hindrance to users).
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - which would still be entered on a compromised device and thus provide 0 to almost 0 additional security. It only prevents a non-persistent remote exploit of the device, which is a very, very small use case of protection. More thoroughly, it only helps you when there isn't key logging on the device, in which case the password for the site wouldn't be compromised and the 2FA token compromise wouldn't matter. There is literally almost no situation (if any) that WiKID's password on the token helps anything.
Nov
17
comment Is Chip and PIN still Broken
Note that this doesn't actually break Chip, just allows an arbitrary PIN to be used if the merchant and issuer don't exchange information about the method of card holder verification. All it would take to fix this is to introduce the ability for the merchant to communicate this to the issuer for any issuers that include the verification method in their transaction data. You still need to have the actual card to make use of it though, so even without any change it is still more secure than mag stripe which can be cloned.
Nov
17
comment Question regarding SSL / TLS / Certificates in general
Adding some clarification for you. Yes, check the main How does SSL/TLS work, but the AES identifies the actual symmetric key used, but that is established by a key exchange which occurs using the certificate. The certificate is what you were making in openssl.
Nov
17
comment Is it possible that authorities can't block a certain website
It wouldn't even be possible to tell who watched it if the stream is encrypted. Multicast streaming doesn't work over the open internet and I don't think TOR has support for it either, so you would need to establish a unique connection for each viewer and the encryption would make it impossible to checksum to identify content. You could possibly length match, but some basic padding on the stream would destroy that.
Nov
11
comment Security implications for email address and url changes?
Right, what kind of client are you viewing it in though?
Nov
7
comment Hashing a hard drive before shutdown
@Jonathan - yes, the OPs entire premise was to store the hash to a USB stick. Basically he wants to be able to have something small that he can keep with him to be able to verify that another drive hasn't been tampered with. Encryption is really irrelevant since he wants to assume that the key is compromised.
Nov
6
comment Hashing a hard drive before shutdown
HDDs have firmware that governs how they operate. Someone could flash an alternate firmware that would mask their changes and tweak data in flight after verification. This could allow them to, say, alter an executable being loaded to turn it in to a root kit that would alter the behavior of your mounting, so you'd have to be very careful of how you mounted to prevent tampering from the HDD firmware. I don't know of anything that handles this kind of threat model as most models are built around the idea that a lost key is a broken system, rendering most of these concerns far less necessary.
Nov
6
comment Hashing a hard drive before shutdown
@JayHolister - yeah, individual file hashes would work, but now you need a much larger amount of data on the USB stick and probably some specialized mounting to verify it. You also have to be careful with how you mount the drive to make sure that the attacker can't use it to launch any attack on your system that would allow it to mask changes they made.
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. - ok, that looks like the ID of the phone itself. Note that you can deactivate, delete or change the label, you can't actually change the UUID. I wouldn't count on that for any security as it is shared by the device like candy if it is the number I think it is.
Nov
6
comment Key Management/storage system
Well that's unfortunate... I added a later paragraph with some ideas, but it's less than ideal.
Nov
6
comment What are the weaknesses of my authentication scheme?
though, of course, there isn't much alternative in the case of a phone.
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. ah, I think I misunderstood what you meant by the UUID of the phone. On Android smartphones, there is a UUID used to identify the phone. If this is a UUID that is generated by lastpass and stored on the phone, that's a bit more secure, though at that point, using an asymmetric key pair would be a far better practice as the OS would also much better protect the private key. Note, it is also somewhat limited usefulness in terms of "what you have" if the "what you have" is directly tied to your client since it doesn't help protect against a compromised client...
Nov
6
comment How to locate a Windows application's hard-coded GUID from a hex dump
Fair enough, still not seeing anything about this security related though. Even if you need it to be the same for some security purpose, this falls under technical implementation methods which aren't generally on topic here, but rather on the site most related to implementing it (ie, StackOverflow in this case)
Nov
6
comment Buffer overflow without using environment variables
We don't need to know an address. We need to know an offset. The structures of how a program loads in to memory are generally consistent, so you would just make a payload that is oversized by enough to be able to push in to some control flow in memory and then hijack it to jump wherever we want. It's not the simplest thing to do in practice, which is why not every overflow can be easily exploited, but the basic principal isn't that complicated.
Nov
4
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
While not an exact duplicate, the reasons for resistance to mandatory encryption on HTTP/2 are the same reasons that sites still use HTTP instead of HTTPS.