32,188 reputation
23483
bio website
location Rensselaer, NY
age 30
visits member for 2 years, 9 months
seen May 24 at 14:45

Oct
21
comment How can these spam emails be accessing email accounts on respected domains?
@LuckyLuke - then I would contact both. They are probably hacking master accounts on rodgers and then creating an account with a different version of the same name. Contact both of them and they will shut down the accounts in question. It's all you can really do.
Oct
21
comment How can these spam emails be accessing email accounts on respected domains?
The other site is probably just a spoof. It's unlikely that they have an actual account there.
Oct
21
comment How can these spam emails be accessing email accounts on respected domains?
@LuckyLuke - it would be good to inform Rodgers. They should have some kind of abuse address that you can send information to or you could just try abuse@rodgers.com It might or might not be accurate, but it's a fairly typical address for such purposes.
Oct
7
comment How can I be secure with a global salt?
@Toto - well if you can throw enough processing power at it, you can randomly search users logins running their password against the bad hashes when they login or change passwords, but that's far less efficient. You can also run ongoing tests of the identified bad password list against existing unique salts to identify problems once they are first detected.
Oct
7
comment How can I be secure with a global salt?
I also described what you need to do, for a new user, take their provided password and hash it with each of the known bad user salts and see if it matches. Once you identify a password of a bad user (based on their second attempt to register with it) then you can store that password as bad and remove the salt from the list as the password is no longer unknown.
Oct
7
comment How can I be secure with a global salt?
@Toto - you are reducing the complexity by orders of magnitude by not salting though. If you are going to store the result of any global salt, you might as well not salt at all for any storage as that is the point of failure and has the least complexity to solve. The idea of a salt is that it requires a separate attack on every password. A global salt/no salt allows for all weak passwords to be found in one fell swoop. The unique salts prevent the weak passwords from being easily identified.
Sep
28
comment What is the most secure operating system out there?
@Mr.Happy - it would be effectively impossible to detect. It could be triggered off of any random operation sequence that would result in the CPU executing privileged instructions without the OS knowing about it. It would be most effective to compromise the CPU itself though. Other methods would be more difficult, so if the CPU is trustworthy you have at least some protection since the CPU won't cooperate with the hijacking then (but some data might still be accessible, such as dumping RAM values via DMA).
Sep
13
comment Can you sniff broadband connections? And how you secure that?
@evening - wireless encryption I already answered. Encryption won't protect you from other people who are legitimately on the network unless you use enterprise level encryption (which is hard to setup) and authentication just establishes that people should be able to be on the network.
Sep
13
comment Can you sniff broadband connections? And how you secure that?
wired would be fine as long as the network is switched, which pretty much all are now. You would have to look at the documentation for the routers and switches that are used in the network to see if it is switched or not, but most are now.
Sep
13
comment Can you sniff broadband connections? And how you secure that?
@evening - it is probably your easiest bet for a wireless connection if you don't trust the other people on the wireless network, but at that point it brings up the question, why are they on your wireless network.
Sep
13
comment Can you sniff broadband connections? And how you secure that?
@evening - you can make it so that wifi uses different encryption per connection, but this requires user level accounts for connecting to the wireless and the use of the enterprise levels of WPA or similar. It is also non-trivial to setup. With a common password, anyone with access to the network will be able to get at the contents of everyone else (on the wireless network)'s packets as they go across the wireless network.
Sep
13
comment Can you sniff broadband connections? And how you secure that?
@evening - you lost me now. If you are asking about people on a wired network within the home network, a good switching based router should isolate each system and only pass along information that needs to go to each IP internally. As long as it isn't going through any hubs (which send to all connections) you should be fine internally.
Sep
13
comment Double encryption with different keys
that is incorrect, it will still be easily detectable even if not human readable. It is fairly easy to pull encryption keys out of compiled code.
Sep
13
comment Double encryption with different keys
Do you care if the users of the program can get at it? The SDK and user keys will be accessible to the systems that have the software installed.
Sep
2
comment How does IIS persist identity credentials? Does it create any security issues?
@ZijingWu - only if there is some HSM available that can respond to the authentication requests of whatever authentication system you are using directly. The key would be that you would have to put it in the HSM in a way that the password is never released. I'm not aware of any such option, but that doesn't mean one might not exist somewhere.
Sep
1
comment How does Tor protect against an attacker just running thousands of nodes?
@FiascoLabs - that's always the case with Cryptography though. There are simply too many possible attack vectors. A mathematical proof of security isn't possible, so the security provided by any mechanism is always based on what we believe to be true. It seems like AES should be hard to break, but we can't know for sure that it is. In TOR however, we know of some critical weaknesses, though it's still one of the best options available for anonymity.
Aug
31
comment Why don't we have any popular decentralized chat systems, social networks etc.?
@ott - not going to happen because those services are still too complex. It requires running your own software, updates, security management, figuring out nodes to trust. It's simply more effort than your general user wants to put in.
Aug
30
comment How should a webmaster manage all her passwords and keys?
Good to know that 1Password supports attachments and can handle keys, also, thanks for playing ball and being honest with the disclosure.
Aug
30
comment Would IT Security professionel people notice a backdoor in Windows 7 or SBS 2011 implemented by Microsoft?
@ddyer - you raise a valid point that a security vulnerability could be left in and written off as an accident, but that still wouldn't explain why the government uses it if there are known holes. Also, those holes are routinely discovered and patched and many still require local code execution to be exploited, which as I mentioned, if you have local control, any OS is screwed unless it is using encryption.
Aug
28
comment In which country can you host a service which honors privacy?
@FakeRainBrigand - encryption keys however have been ordered to be produced before by judges.