28,180 reputation
22766
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 4 hours ago

Aug
2
comment Why is SHA-3 (keccak) considered more secure than DES when you can attempt to crack it 3x faster?
@LucasKauffman more like apples to lego bricks
Aug
2
comment Why would one increment card security code for a new payment card
@CallumWilson - good to know, thanks for the extra detail.
Jul
31
comment NSA and facebook chats
@user129789 - no where in the linked article did it say anything I could find about TCP/IP. In theory, depending on the type of SSL, if the private certificate was shared, then the SSL key exchange could be decoded and HTTPS traffic could be directly decoded, but this would still be due to collusion on Facebook's part. Facebook is in the business of selling your information, this really shouldn't be a surprise.
Jul
30
comment Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key
@ThomasPornin - excellent. I didn't recognize the format being used from only having that limitation. I figured there was some header on the format being used, but wasn't sure which it was.
Jul
30
comment Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key
And why is the size limit 117 bytes?
Jul
30
comment How do I forensically determine whether a mobile phone has been infected with a spy suite?
@derobert - I think he was responding to my earlier comment that a Faraday cage (such as say an old microwave) would work wonders if you put a wifi hotspot in with it via a wire.
Jul
28
comment A protocol to authenticate users without login/password
@Amit - I suppose you could make a program that would generate a key pair based on the information put into it, but that would greatly reduce the security of client certificate based authentication. You would still use the same existing client certificate infrastructure, just the method of generating the key pair would have to be altered to make a derived key.
Jul
27
comment What's the best way to send and receive lots of login credentials?
@piña - be sure to use password protected files as well if the SFTP folders are accessible to multiple people unless everyone that has access to the folder is also supposed to have access to the passwords.
Jul
27
comment What's the best way to send and receive lots of login credentials?
It's a common misconception that the web and the Internet are the same, but they are not. World Wide Web refers to HTML content covered by the standards of the world wide web consortium (W3C) which governs the HTML standard and how websites interact, but has nothing to do with other Internet services, such as e-mail, RDP, VPN, IRC, FTP, VoIP, etc, etc.
Jul
27
comment What's the best way to send and receive lots of login credentials?
@piña - it's a minor detail, but technically, the web is the HTTP/S network while e-mail is another service on the Internet, so e-mail is an Internet protocol rather than a web one. That's why most websites start with "www." but most mail servers start with "mail.", "smpt.", "pop." or "imap." The beginning of a URL actually has to do with the service being provided on that URL as the highest level of the domain name and the http:// tells the URL that it is a hypertext transfer protocol that should be used to access the resource.
Jul
26
comment My VPS has been shut down now again for the second time for TOS violations, and I really need some help.
@Ekaj - that may be the case, but in that case, without more details, we can't really help him with that either and it would likely be too localized anyway.
Jul
25
comment Avoiding MITM attacks when using HTTPS over mobile
Ah, ok, they are apparently not validating the SSL certificate is trusted. That's a pretty big flaw as well, but is just an incorrect implementation of SSL within their app. Proper implementation of SSL should verify that the server certificate is trusted prior to sending data.
Jul
25
comment What's the best way to send and receive lots of login credentials?
Put another way, it normally looks like User's Computer ---(A)---> Webmail Server ---(B)---->User's ISP's Email Server ---(C)----> Any intermediate mail servers ---(D)---> Recipient's Mail Server ----(E)-----> Recipient's Computer. HTTPS only protects communication A. Communication C may or may not go straight to D depending on configuration and relays, but B,C,D, and possibly E are all not impacted by HTTPS and would be in the clear unless SSL or TLS is used and there isn't a good way to guarantee that TLS or SSL is used.
Jul
25
comment What's the best way to send and receive lots of login credentials?
@piña - Webmail is generally a web client for an e-mail service. Gmail may be different in that I don't know what they use as far as e-mail servers, but generally there is a webserver which hosts a webmail client and an e-mail server that handles actual delivery and storage of e-mail messages. E-mail servers communicate on different ports with different protocols than web traffic. HTTPS protects the web traffic portion of using a webmail client, but it does nothing to encrypt and protect the actual exchange between the webmail server and the mail server or between other mail servers.
Jul
25
comment No advanced settings option in router
Get a different router?
Jul
25
comment How do I forensically determine whether a mobile phone has been infected with a spy suite?
@CallumWilson - yeah, if you have the resources to make an image, that is preferable. I just put my idea out there as it is a cheap and minimally invasive way to attempt to determine if there are issues without risking further software being installed by you by accident.
Jul
25
comment What's the best way to send and receive lots of login credentials?
@EricG - that was my guess too, but that doesn't actually provide any security to the e-mail itself. My point was that webmail isn't sending an e-mail, it's just a web based client that connects to the e-mail server, often over an unencrypted link.
Jul
24
comment How do I forensically determine whether a mobile phone has been infected with a spy suite?
@e-sushi - I'm not sure that it wouldn't be forensic evidence since the software isn't actually being altered. Entering airplane mode isn't significantly different from trying to boot up an image on different hardware. It's still a non-destructive processes. An alternate approach would also be to toss it in a faraday cage if turning off cellular was considered too much of a change.
Jul
24
comment How do I forensically determine whether a mobile phone has been infected with a spy suite?
Whoever downvoted, could you please comment as to why you don't think traffic analysis is a viable way to identify a hidden piece of software that might be transmitting data to a third party? If the device can't be tampered with or trusted, monitoring it's connection to the outside world is the best bet.
Jul
24
comment A “new domain registration” spam?
Yeah, there are some really dirty practices out there. Some less reputable places that let you check name availability will actually go and do short registrations on names you look for too and then try to sell them to you.