AJ Henderson

10,709 reputation

1834

bio	website
	location	Troy, NY
	age	28
visits	member for	8 months
	seen	32 mins ago
stats	profile views	313

	10,709 reputation	bio	website		visits	member for	8 months
1834 badges		location	Troy, NY		seen	32 mins ago

summary answers questions tags badges favorites bounties reputation activity

481 Comments

suggestions reviews revisions comments badges posts accepts all

Jan 2	comment	How to setup GPU for Cracking WPA/WPA2? @Polynomial - ah, I saw it as really being two questions. One is how do you get CUDA (or OpenCL) to work reliably on Optimus setups. That is more of a hardware question than an IT Security one, so I addressed it in a comment. Optimus will shut off the NVidia GPU if it doesn't detect graphics operations, so it must be disabled. I then answered the remaining question of how to do the analysis and at a broad level, as I understand it, generating a rainbow table to match the key to the handshake is the way to brute force that.
Jan 2	comment	Is SiteKey a valid defense against Phishing? It isn't valid as a stand alone measure and only amounts to security through obscurity, but knowing the discussion that took place on the other question, I think this question is trying to see if it is beneficial as an additional step in a defense in depth approach, even if it does nothing but raise the technical bar. Perhaps a better way of asking is, does SiteKey have a net positive, net negative, or no effect on the security of a site.
Jan 2	comment	How to setup GPU for Cracking WPA/WPA2? Whoever down-voted, could you comment as to why so I can fix it or address the concern? Was something unclear about my answer?
Jan 2	comment	How to setup GPU for Cracking WPA/WPA2? Oops, forgot to mention, it would also be best to ask hardware related questions on Server Fault or Power User since that part of the question is not actually IT Security related.
Jan 2	comment	How to setup GPU for Cracking WPA/WPA2? Optimus is kind of a pain when it comes to using CUDA. You will need to disable Optimus so that the hardware is running exclusively on the NVidia GPU before you can reliably use CUDA. CUDA is not supported by the Intel GPU. I would also suggest that this is really two questions rather than one. The first is a question about how to use GPU optimization on a hybrid graphics setup. The second is about performance characteristics of various attacks on WPA/WPA2.
Jan 2	comment	Wifi login redirect applications @us2012 If they are using the implementation I described (MAC filtering), then yes, it could be bypassed in that manner. I'm not sure what other direct methods the AP could use to identify a unique client. I suppose other options could be a proxy that would look at some cookie or require an encrypted connection. As far as I know this would require a step less transparent to the user though. Another option would be to hand off the connection to another network using WPA Enterprise after login. This would allow for each connection to be uniquely encrypted at the transport (wireless) layer.
Jan 2	comment	encrypted cloud storage with partial local copy I updated your post to try to make it easier to read as I understood your intent.
Jan 2	comment	Wifi login redirect applications DD-WRT is a replacement firmware that can installed on many routers. I think the majority of systems like the one described in the question require hardware support at some level since they have to be able to redirect users differently based on authentication, though there might be a software system that could run on a computer acting as a gateway as well.
Jan 2	comment	What is this authentication method/approach called? @DavidStratton - yes, I saw that and just replied to it with a more complete answer that looks at what it can potentially offer, what it can potentially hinder and what possible alternatives are to it.
Jan 2	comment	What is this authentication method/approach called? @Polynomial - that assumes that the phishing site goes directly. It wouldn't be that hard to setup a relay on a botnet to get the page from a variety of different IPs so as to appear like a client while masking the IP of the phishing site. It is an additional step, but it still amounts to security through obscurity.
Jan 2	comment	What is this authentication method/approach called? @DavidStratton - good point about not actually answering the question. I have altered my answer to include the name I normally search for information about it under as well as using the technical name for it as an introduction in to why I advise against it.
Dec 20	comment	How can I explain the concept of public and private keys without technical jargon? True, but the question is asking about Public/Private key encryption, not encryption in general. Simply saying it is like a lock doesn't explain anything about what public/private key encryption is, just what encryption in general is.
Dec 20	comment	How can I explain the concept of public and private keys without technical jargon? This really describes shared (symmetric) key encryption more than public/private key (asymmetric) encryption.
Dec 20	comment	Is a One Time Password Scheme based on Diceware viable and secure? @KeithS - There are PRNGs that are cryptographically secure in that for a given key, they produce a random distribution of numbers if you can hide the variables involved, but that doesn't mean you can't work backwards from a given known output to the seed value. In order for two PRNGs to be able to generate the same value from the same seed, the other variables are going to have to be known. In this case, the PRNG should be fairly easy to reverse the logic on and get to a seed value in most cases. Do you know a particular PRNG algorithm that would be resistant to this?
Dec 20	comment	Is a One Time Password Scheme based on Diceware viable and secure? @apgwoz - You would need a new way to synchronize the seed then. You'd still be trying to address the inherent weakness of the fact that an RNG is likely not secure against determining the seed from a large enough set of output. It doesn't offer anything over the cryptographically based symmetric key and time system that is most commonly used.
Dec 17	comment	How to authenticate a salted password? it isn't even limited to just running ahead of time. If this was the case, salt per db would be fine. It is also to prevent attacking the DB as a whole simultaneously. Rather, per record salts require that a separate rainbow table be computed for every record.
Dec 17	comment	How to authenticate a salted password? @Thomas - updated to clarify that 32 bits isn't secure. You're right that that is probably worth mentioning even if not directly relevant to the question at hand.
Dec 14	comment	Physical Security for USB Keys and Systems-on-a-Stick @JohnDoucette - yeah, if there is anything else that would work, it would be highly specialized (like a special USB drive that included that kind of a function). There isn't really anything else universal to lock on to on every model of laptop.
Dec 14	comment	Precedent for an in-house cardholder information server? What kind of volume are you dealing with. Would it be easier to use a third party service to handle the PCI for you. Many services exist that will use tokens for transaction management. Basically you ask the card processing system to process a transaction with given details and associate a token code to it. The system then processes the transaction and responds back with the status of the transaction when it succeeds or fails. This can be done either with an external vendor or an internal system. The main security concern then is ensuring that you authenticate the communication.
Dec 14	comment	Why don't people hash and salt usernames before storing them @Grezzo - If you have a display name stored separately, the majority of people are going to make their display name closely resemble their username. If you generate their username, then it reduces usability.