31,104 reputation
23278
bio website
location Rensselaer, NY
age 30
visits member for 2 years, 4 months
seen 13 hours ago

Sep
13
comment Can you sniff broadband connections? And how you secure that?
@evening - you lost me now. If you are asking about people on a wired network within the home network, a good switching based router should isolate each system and only pass along information that needs to go to each IP internally. As long as it isn't going through any hubs (which send to all connections) you should be fine internally.
Sep
13
comment Double encryption with different keys
that is incorrect, it will still be easily detectable even if not human readable. It is fairly easy to pull encryption keys out of compiled code.
Sep
13
comment Double encryption with different keys
Do you care if the users of the program can get at it? The SDK and user keys will be accessible to the systems that have the software installed.
Sep
2
comment How does IIS persist identity credentials? Does it create any security issues?
@ZijingWu - only if there is some HSM available that can respond to the authentication requests of whatever authentication system you are using directly. The key would be that you would have to put it in the HSM in a way that the password is never released. I'm not aware of any such option, but that doesn't mean one might not exist somewhere.
Sep
1
comment How does Tor protect against an attacker just running thousands of nodes?
@FiascoLabs - that's always the case with Cryptography though. There are simply too many possible attack vectors. A mathematical proof of security isn't possible, so the security provided by any mechanism is always based on what we believe to be true. It seems like AES should be hard to break, but we can't know for sure that it is. In TOR however, we know of some critical weaknesses, though it's still one of the best options available for anonymity.
Aug
31
comment Why don't we have any popular decentralized chat systems, social networks etc.?
@ott - not going to happen because those services are still too complex. It requires running your own software, updates, security management, figuring out nodes to trust. It's simply more effort than your general user wants to put in.
Aug
30
comment How should a webmaster manage all her passwords and keys?
Good to know that 1Password supports attachments and can handle keys, also, thanks for playing ball and being honest with the disclosure.
Aug
30
comment Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?
@ddyer - you raise a valid point that a security vulnerability could be left in and written off as an accident, but that still wouldn't explain why the government uses it if there are known holes. Also, those holes are routinely discovered and patched and many still require local code execution to be exploited, which as I mentioned, if you have local control, any OS is screwed unless it is using encryption.
Aug
28
comment In which country can you host a service which honors privacy?
@FakeRainBrigand - encryption keys however have been ordered to be produced before by judges.
Aug
27
comment Credential (et al) storage on Android - And general application credential storage inquiry
Oh, one other thought, if you want more of an extended discussion kind of thing, you might try seeing if anyone is interested in talking about it in chat. Open discussion is fine and encouraged there.
Aug
27
comment Credential (et al) storage on Android - And general application credential storage inquiry
while I personally didn't vote to close on this one, it is worth highlighting that this specifically is NOT a forum. It is a Q/A site. It's designed as a place for people to get answers to questions and so questions need to be answerable. In this case, people felt that there couldn't be a concise answer. If you are looking for general discussion, a Q/A site isn't the place. If you are looking for an answer to a specific problem, perhaps you can refine it to a question of how to accomplish a more specific goal and that might be seen as a narrow enough scope.
Aug
27
comment Difference between Privilege and Permission
@Gilles - hmm, perhaps that was what I was thinking of. I don't work in the Unix world much, but I did take a Unix admin course in college and I remember it from around that time. Hmm, or it may have been RBAC.
Aug
27
comment Credential (et al) storage on Android - And general application credential storage inquiry
I'm not sure if it would help of not, but there might be some stuff that can be done by services that register themselves as Device Administrators. I'm not sure if they get an independent keystore or not, but it might be someplace to check in to.
Aug
26
comment How is wireless WiFi password cracked?
@LucasKauffman - good point, I had forgotten about that as I didn't really consider it salting as it isn't unique, but it is worth mentioning it makes it slightly more difficult, though not too much. I updated my answer accordingly.
Aug
24
comment How to prevent man-in-the-middle attacks beside of SSL?
It's a little hard to tell what you are asking, but I have tried to give a broad explanation to see if it covers what you are trying to figure out. Please clarify your question further if this doesn't handle your needs.
Aug
23
comment Is PGP secure against a rogue keyserver?
@Chaos_99 - you don't trust someone named Bob, you trust a public key that you obtained from Bob via a mechanism you trust. You store that key in a place on your system configured as a trusted root. Yes, you have to obtain it securely, but it doesn't have to be traced back to your key, it can be traced back to Bob's key which you hold the public key for. Names on keys are more or less just for human readability and the ability to look up which key to try to verify against (so you don't have to try them all.)
Aug
23
comment Bank Fraud Deposit
The only odd thing about it possibly being a money mule is that it is over $10k. Normally mule transfers to or from the US are made in the order of less than $10k since that is the reporting limit over which the transaction is reported to the feds. My brother has stories about working Wells Fargo at the local grocery store and having $9,999 transactions fairly regularly.
Aug
23
comment Is PGP secure against a rogue keyserver?
@Chaos_99 - that is correct, though you could also use a secure primary channel as well if you have one available, though that is also really just moving back the root of trust. (For example, say I had a cryptographically secured line between me and Bob, then I could trust the key sent over it without further verification, but at some point I had to get a trusted secret for that connection.) But you are conceptually correct that at some point, it still comes down to establishing trust the old fashioned way (to whatever level of security is necessary for your purpose.)
Aug
23
comment Is PGP secure against a rogue keyserver?
@Chaos_99 - it doesn't necessarily have to be traced back to your private key, just to a key in your trusted key ring. I may trust Bob's certificate but not sign it. Even if I don't sign it, if I see that Charlie is signed by Bob, I know that Bob is a trusted root, so I can trust Charlie. If Charlie then trusts Daniel, I can trust Daniel since Charlie trusts Daniel, though I may decide to put a little less confidence in it since I don't know how trustworthy Charlie is.
Aug
23
comment Is PGP secure against a rogue keyserver?
As far as the behavior of GnuPG, I do not know if it does this or not, but it wouldn't be hard to do manually. Just sign something and then use the public key to verify the signature.