28,990 reputation
23072
bio website
location Troy, NY
age 30
visits member for 2 years, 1 month
seen 2 hours ago

Aug
11
comment A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible?
@Samuel - all depends on the level of logs kept at each place. If they keep logs of routing paths at your home ISP your done, but if not, you might be ok. It can also be further improved by using TOR to route the traffic in a harder to log way, but I'm not sure what kind of latency penalty that might give.
Aug
11
comment A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible?
@Samuel - yeah, I see the open wifi bit now, all of my analysis prior was based on using your data connection rather than third party wifi. You'd still have the issue of matching in and out on a low latency connection though. If they are monitoring your home internet, it would have to forward the call quickly after going in. They could detect the inbound packets and based on volume, figure out someone is remote accessing it. They could then trace the IP that is connecting in to your home. It is slightly harder, but still can be beaten fairly easy.
Aug
11
comment A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible?
@Marcel - yeah, the key distinction is he did mention using open wifi briefly, I missed it too.
Aug
11
comment Can a VPN avoid the Prism Surveillance Programme?
@Nitrl - It should be assumed that ISPs that provide connection to the VPN are going to cooperate with law enforcement, if so, the data going in to the routers and coming out of the routers can be matched up based on time and traced that way. If the network is low latency, I send VPN exit node a packet and it immediately sends it out again from itself. Anyone that has visibility of the routing of both the incoming and outgoing packets can put two and two together than the incoming request was forwarded.
Aug
11
comment A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible?
@Samuel - they can trace your data connection of your cell. If someone was tracking you, they would be monitoring your cell phone anyway. You could have the call "appear" to come from home, but when they see your cell phone data connection is in a graveyard 500 miles away, they'll figure it out pretty quick. If you have it on wi-fi only then you would be a little better off, but no better than using any proxy.
Aug
9
comment Full Disk Encryption with GPT disk support
Don't backup the key online then. I can't imagine you are required to share your keys. That would make it a non-starter for many enterprises that use BitLocker.
Aug
9
comment Full Disk Encryption with GPT disk support
if you are going to doubt that BitLocker will protect your data, then you shouldn't trust that UEFI isn't going to allow something to be loaded before the OS to hijack your system for the government. I'm not saying I think it is likely, but simply pointing out that it's just as likely to open up abuse as BitLocker is. It was a statement about your not wanting to use Bitlocker, not a statement about UEFI being bad.
Aug
9
comment Full Disk Encryption with GPT disk support
If you don't trust BitLocker, you really probably shouldn't trust UEFI either. Putting a back door in BitLocker would be extremely risky (to the scale of MS ceasing to be a company) if it was ever discovered and abused. It's a night and day difference between letting the government access some unencrypted online records vs compromising secure systems everywhere to open a back door of dubious merit.
Aug
9
comment What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?
@drjimbob - That's a valid point about SSL keys for hardware if you are running a server, but S/MIME particularly is the e-mail / personal encryption certificate side of things, so the private key would be on local hardware. And yes, they could keep a copy, which is why for the highest security, you should gen your own and have them sign your certificate instead.
Aug
9
comment Are local firewalls necessary
Process awareness also allows for better filtering of the use of allowed protocols. You don't want ImAVirus.exe to be able to use some allowed network protocol to communicate out.
Aug
6
comment Danger in opening spam emails on Ubuntu operating system
Improbable unless he is targeted for some reason. It's probably worth noting that it is certainly highly possible that a targeted virus could be a problem, but that is unlikely for most users.
Aug
6
comment Danger in opening spam emails on Ubuntu operating system
@MohammadRezaTayyebi - your question is rather hard to follow. It has technical inaccuracies in the description and the title of the question is asking about opening spam emails on Ubuntu. I chose to answer the questions as broadly as possible to get whatever your meaning may have been. As I indicated, some viruses will still work on Linux OSes as viruses do exist for Linux. If you are targeted, you could be infected though general messages probably won't work unless you are careless and unlucky.
Aug
5
comment How could I totally secure a connection between two nodes?
@cp151 - a secure channel can be as simple as a phone call or some form of identity verification, but ultimately, it is not possible to communicate with anything securely without first establishing trust through some mechanism. Trust can only be achieved through verification which requires some type of trusted interaction between nodes.
Aug
3
comment Why is SHA-3 (keccak) considered more secure than DES when you can attempt to crack it 3x faster?
@user129789 - LM hash is very weak because it simply tries to use a weak DES key to encrypt a known value and store it as a "hash". Yes, it is a unique value for a given input that is likely to change if the input changes, but it's more of an obfuscation algorithm than a true hash and it has multiple critical weaknesses in addition to not being able to deal with anything other than a 1 to 14 character input. No other "real" hash function that I know of has that limitation. Also, DES isn't what provides the security (or lack there of) for the hash, it's how the data is permuted that is bad.
Aug
2
comment Microsoft password email reset link leads to different url?
Can you mention what it said it went to and what it actually went to (with any tokens altered obviously.)
Aug
2
comment Why is SHA-3 (keccak) considered more secure than DES when you can attempt to crack it 3x faster?
@user129789 - DES is not a hashing algorithm and can not be used as such. It is non-reductive. LanMan is poorly described as a hash, though it doesn't reduce the data set as the output is 16 bytes and describes a 14 byte input. By definition, hashes should reduce the length of the input for any input longer than the hash length. DES output is the same length as the input.
Aug
2
comment Why is SHA-3 (keccak) considered more secure than DES when you can attempt to crack it 3x faster?
@LucasKauffman more like apples to lego bricks
Aug
2
comment Why would one increment card security code for a new payment card
@CallumWilson - good to know, thanks for the extra detail.
Jul
31
comment NSA and facebook chats
@user129789 - no where in the linked article did it say anything I could find about TCP/IP. In theory, depending on the type of SSL, if the private certificate was shared, then the SSL key exchange could be decoded and HTTPS traffic could be directly decoded, but this would still be due to collusion on Facebook's part. Facebook is in the business of selling your information, this really shouldn't be a surprise.
Jul
30
comment Splitting up symmetric key to be able to encrypt using 1024 bit RSA public key
@ThomasPornin - excellent. I didn't recognize the format being used from only having that limitation. I figured there was some header on the format being used, but wasn't sure which it was.