30,949 reputation
23278
bio website
location Troy, NY
age 30
visits member for 2 years, 3 months
seen 1 hour ago

Nov
7
comment Hashing a hard drive before shutdown
@Jonathan - yes, the OPs entire premise was to store the hash to a USB stick. Basically he wants to be able to have something small that he can keep with him to be able to verify that another drive hasn't been tampered with. Encryption is really irrelevant since he wants to assume that the key is compromised.
Nov
6
comment Hashing a hard drive before shutdown
HDDs have firmware that governs how they operate. Someone could flash an alternate firmware that would mask their changes and tweak data in flight after verification. This could allow them to, say, alter an executable being loaded to turn it in to a root kit that would alter the behavior of your mounting, so you'd have to be very careful of how you mounted to prevent tampering from the HDD firmware. I don't know of anything that handles this kind of threat model as most models are built around the idea that a lost key is a broken system, rendering most of these concerns far less necessary.
Nov
6
comment Hashing a hard drive before shutdown
@JayHolister - yeah, individual file hashes would work, but now you need a much larger amount of data on the USB stick and probably some specialized mounting to verify it. You also have to be careful with how you mount the drive to make sure that the attacker can't use it to launch any attack on your system that would allow it to mask changes they made.
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. - ok, that looks like the ID of the phone itself. Note that you can deactivate, delete or change the label, you can't actually change the UUID. I wouldn't count on that for any security as it is shared by the device like candy if it is the number I think it is.
Nov
6
comment Key Management/storage system
Well that's unfortunate... I added a later paragraph with some ideas, but it's less than ideal.
Nov
6
comment What are the weaknesses of my authentication scheme?
though, of course, there isn't much alternative in the case of a phone.
Nov
6
comment What are the weaknesses of my authentication scheme?
@HadrienG. ah, I think I misunderstood what you meant by the UUID of the phone. On Android smartphones, there is a UUID used to identify the phone. If this is a UUID that is generated by lastpass and stored on the phone, that's a bit more secure, though at that point, using an asymmetric key pair would be a far better practice as the OS would also much better protect the private key. Note, it is also somewhat limited usefulness in terms of "what you have" if the "what you have" is directly tied to your client since it doesn't help protect against a compromised client...
Nov
6
comment Buffer overflow without using environment variables
We don't need to know an address. We need to know an offset. The structures of how a program loads in to memory are generally consistent, so you would just make a payload that is oversized by enough to be able to push in to some control flow in memory and then hijack it to jump wherever we want. It's not the simplest thing to do in practice, which is why not every overflow can be easily exploited, but the basic principal isn't that complicated.
Nov
4
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
While not an exact duplicate, the reasons for resistance to mandatory encryption on HTTP/2 are the same reasons that sites still use HTTP instead of HTTPS.
Nov
4
comment Can you store sensitive app config vars in the environment and be PCI compliant?
@user1475135 - updated my answer to be consistent with that. Unfortunately, I don't remember the specific DB credential storage guidelines as I haven't had to deal with PCI-DSS myself for the last couple years. I'll let someone else speak up on that.
Oct
31
comment Why use a Smartcard for (Two Factor) Auth instead of another medium?
@Bristol - in that case there are two different encryption keys. The key on the card is still never shared, but rather the computer would have an encryption key for the hard drive which is encrypted with a key on the smart card. The smart card would provide decryption of the key for the computer, but still wouldn't actually share the key used for decrypting that key. An offline attack would be possible where the key for the hard drive could be decrypted if the smart card was compromised for a short period though, but it still requires an attack on the computer prior to attacking the card.
Oct
31
comment Security implications for email address and url changes?
Where are you seeing them replaced as that? Is it in the mail client or in the header itself? It appears like the client is just parsing the e-mail and then replacing it with a link to part of the webmail interface.
Oct
30
comment How to report vulnerabilities without being regarded as a hacker?
@schroeder - fair enough, I would concur that it is probably best to make the most understandable and simplest explanation possible. People are less likely to freak out (justifiably or not) if you are using tools they understand instead of stuff that goes over their heads.
Oct
30
comment How to report vulnerabilities without being regarded as a hacker?
@schroeder - but this doesn't even require capturing the packets (which, btw, you have to do to see a page). It only requires looking and seeing http:// instead of https:// when you mouse over the link submission or viewing the source of the page. It can be done right from the browser.
Oct
27
comment Forensic Question Invisible User
@Raven - you think incorrectly. They could also be used for scheduled tasks, configured to be the user that runs a link for a user, or any of a number of uses where a process has to occur on a privilege set other than a normal user. You shouldn't have to tweak anything in the registry for them. That would be horribly unusable and lead to errors, which would be bad for security. It doesn't have a user profile because it doesn't need one. Again, this is working as designed and is not an issue, you simply don't understand their usage correctly.
Oct
27
comment {Secure} Telnet connect to a console server from webbrowser
In that case, the security related answer is either chain the VPN connections or use an encrypted web server connection. Designing a website that could be used as a Telnet client is off topic though as it isn't security related. It sounds like the security related portions of the question are answered now.
Oct
27
comment Forensic Question Invisible User
In other words, the behavior you describe is not a security issue and is working as intended.
Oct
27
comment Forensic Question Invisible User
@raven - service users should have passwords and can have low priviledge if that is all they need. They also don't have to be associated with a windows service, that's something entirely different from a service user. Service users can be used for a number of other reasons. Often they are configured to not allow being used by a user for logon, but sometimes they have to be able to login and act like a user. Putting a user in both Services and Remote Desktop Users is a bit odd, but still not a security concern as the behaviors are still logged on a properly configured box.
Oct
22
comment UPS my choice — How can I access my public records?
@SnakeDoc - it's all public records. Birth certificates and places of residence. Mail forwarding services, etc.
Oct
21
comment What is the difference between “key length” and “bit strength”?
@woliveirajr - not sure I see how that is a duplicate. It gets at a kind of similar concept, but doesn't even mention key length specifically, just ambiguous strength.