26,545 reputation
22661
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 2 hours ago

Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - what it really is is theater. The level of randomness that most people are going to put in to choosing a phrase is likely pretty small, so the actual entropy of such an additional check is going to be pretty small, even for the length. A little social engineering is also likely to overcome it as people don't understand how the security measure is supposed to work. It might be slightly better than no additional info being needed over the phone, but not by much, it is mostly for show so that people FEEL like their money is being protected. Just like "enhanced" airport security.
Jun
19
comment My cookies have been stolen. What to do?
Find the cookie monster and ask for them back?
Jun
18
comment Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
@ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others).
Jun
18
comment How easy is it, really, to be hacked as an average user?
You should add "patches up to date" to that list, but then, you really aren't an average user with all those criteria set, but rather a security conscious one.
Jun
18
comment Is it secure to use email to add content to a website?
I can send an e-mail from any address to any address and it will go through unless both the recipient and sender are following one or more optional security features. The full spectrum of those technologies is a couple questions worth of info, but look in to things like DKIM and SPF.
Jun
18
comment Is a long salt usually sufficient for security purposes, even with MD5?
@user2175923 - It seems you don't understand the attack you are trying to protect against. The attack you are describing in your question is where an attacker already HAS the hash values stored in the DB for each user and is trying to figure out the password from that. They hash a bunch of possible values and look for a match. If they are able to even attempt this attack, it means that the DB had to be compromised to get the hash values. It would be silly to assume they didn't also grab the salt values while they were there. Salting is a protection for in case the DB is compromised.
Jun
18
comment Is it secure to use email to add content to a website?
Yes, but you just ruled it out as a possibility. Signing is the only option. For some senders it MIGHT be possible if they use TLS and use some anti-spam features that validate the server, but not all senders do this, so it isn't reliable, nor is it particularly trivial to validate.
Jun
18
comment Is a long salt usually sufficient for security purposes, even with MD5?
@user2175923 - A salt CAN'T be in the source code as it MUST be random for each hash or it is completely worthless. The attack you describe assumes that the attacker has the hash values, which means the DB was compromised, thus salts are also compromised. When you apply a salt, you combine the password input and the salt together to form the input that you hash. If you are relying on length of input to slow down hash collision attempts, then you need a long input that can't be optimized from case to case in order to guarantee that it actually makes each hash slow enough.
Jun
17
comment How secure is my method?
@Dogeatcatworld - I may have been reading too much in to it, but it sounded like he was planning on just passing the queries as parameters and returning the raw data set. If I misunderstood that, then my answer should be interpreted a little differently.
Jun
16
comment Is it possible to read files in a mobile phone for carriers through mobile network alone?
They may still be able to turn on data service remotely, but unless someone put a back door in to the phone's OS, then there wouldn't be a way to access it. It depends how much you trust the OS/Phone manufacturer. I'm aware of carriers installing tools on phones, not so aware of phone makers doing it on unlocked devices though.
Jun
5
comment How to detect the so-called “undetectable” Gameover Zeus?
Ah, I didn't even see any mention of it being undetectable in the PC World article, but I did only scan it briefly.
Jun
5
comment How to detect the so-called “undetectable” Gameover Zeus?
What makes you think this is "undetectable". It is talking about a botnet. Bot nets are trivially detectable locally since they involve your computer making unusual network activity in order to do work for the botnet and receive commands. The problem with botnets is that many people don't bother taking these steps, which allows botnets to form in the first place.
Jun
5
comment Does CVE-2014-0195 affect HTTPS?
He was describing what generally uses DTLS. That's the key part. DTLS is the vulnerable component. If you are using it, then vulnerable, if not, then you aren't.
Jun
5
comment Is it possible to protect my Windows XP users now that Microsoft is no longer releasing security updates?
@WilliamHendric the reason I didn't mention what Travis mentioned is that there is no cost effective long term option.
Jun
4
comment Automate the process of giving a user access to his encrypted messages, when the user loses his password
@bullyduckyy - it is basically the same as the user version, you just encrypt it with a public key rather than a symmetric one derived from the user's password (since the user doesn't have access to the admin account)
Jun
4
comment Automate the process of giving a user access to his encrypted messages, when the user loses his password
No, you should store the encrypted private key, but should only store the form that is encrypted based on the user's password or the admin password. This is why an admin needs to take action to unlock a password reset. Because without the password, the user can't access their private key, so an admin must unlock their copy of the private key and then provide it to the user to be encrypted using the user's new password.
Jun
4
comment Automate the process of giving a user access to his encrypted messages, when the user loses his password
@bullyduckyy - that isn't deriving the key from the password you give it. It is using the password to encrypt the private key. If you used that twice, you would get different keys. Storing public keys is fine (and necessary), that's why they are public. What polynomial is describing in that post is what I am trying to describe in my answer here (roughly).
Jun
4
comment Automate the process of giving a user access to his encrypted messages, when the user loses his password
@bullyduckyy - You seem to have a pretty substantial lack of understanding about how asymmetric cryptography works. You don't make an asymmetric keypair from a password. You (generally) make it from random psuedo-primes and then encrypt the private key with a symetric key derived from the user's password (and possibly another public key if you need an administrative recovery) and store the public key unencrypted so that other parts of the system can encrypt stuff for that user.
Jun
4
comment Automate the process of giving a user access to his encrypted messages, when the user loses his password
The point of using encryption is that if the DB or server is compromised, an attacker can't access the data. If you store the encryption keys in an accessible format, then the encryption does nothing. You should have to unlock the encryption keys before they can be used. Normally this would be done by the user's password (they key is still stored on the server, but it is protected by a key derived from the user's password).
Jun
4
comment Is it possible to protect my Windows XP users now that Microsoft is no longer releasing security updates?
@Willamhendric - while it is a good idea to use security products, it will not protect your computer against a lot of threats. Many security flaws in Windows, when exploited, can bypass the protection of third party security software because they can force the OS to do things. Third party software works by looking for other user software that is causing issues and telling the OS to stop it. Security flaws in the OS allow the attacker to be the OS. So the third party security software would be asking the attacker to stop themselves. (That's oversimplified, but gets the basic idea.)