29,630 reputation
23176
bio website
location Troy, NY
age 30
visits member for 2 years, 2 months
seen 10 hours ago

Jul
17
comment How can my .exe become infected?
@esqew - fair point, that was the first one that came to mind, but there are many other similar options. I'd welcome a suggestion for a better example to use.
Jul
10
comment How can Joe Citizen report or at least hamper a phone-based PC scammer?
Some system admins I know decided to have fun with them and kept "going to look for things" and kept them on hold for a few hours while they kept working until they got bored. Personally, I always like to tell them it says "C:\" in the lower right corner of my screen. They always get confused. It is worth noting though, most of the people actually making the calls seem to think they actually work for Microsoft. So they may not know they are working for a scammer.
Jul
9
comment Software for web hacking?
You can do SQL injection and XSS with any browser, you don't need special software. Beyond that, this question is far too broad.
Jul
8
comment Mobile Backend Server: How to validate authenticated client is valid?
you generally can't trust the client for authentication, though a local client may be able to have the server generate a token without additional user interaction. I'd personally probably skip the local authentication step and/or do them both simultaneously though. It's hard to say without knowing more about what your app needs to be able to do though. Big thing is you can't trust the client directly though, only Facebook or Google's server can tell you who the user is, even if that is via something that they give the client to give to you.
Jul
8
comment Mobile Backend Server: How to validate authenticated client is valid?
Look in to oAuth, it is covered pretty heavily here already. It covers how to handle authenticating a user against something like Google or Facebook.
Jul
2
comment Custom surveillance protection
@AlexH - no one has yet broken my /dev/null encrypted volume. Unfortunately, I seem to have trouble reading anything back from it.
Jul
2
comment When do governments allow export of cryptography software?
There is a HUGE difference between having a copy of the algorithm and understanding the math behind why it works. Cryptography is generally one or more graduate level course and has prereqs in various advanced discreet math concepts. It is very non-trivial.
Jul
2
comment When do governments allow export of cryptography software?
@HRJ - that is why they have to get a license exception. The review looks at how the software can be used to make sure it fits the use case. You couldn't export code that was designed to work with military radios because it would fail to pass the export checks. You can export something for letting smartphones send encrypted text messages. If some enemy nation wants to have their soldiers sending secure text messages, they can grab the software and make use of it, but without someone familiar with the encryption, it will be slightly harder to re-purpose the algorithm for a secure radio.
Jul
2
comment When do governments allow export of cryptography software?
@AndrewHoffman - the export controls don't really have much in the way of effective teeth, but they do effectively control what US trained cryptographers can do and where they can work if they plan on coming back to the US or a country that extradites to the US. Much of the concern is not so much enemies of the US getting the software as it is learning to understand how and why the technology is implemented the way it is so that they could make their own derivative work. still probably not particularly effective, but since when does that stop the government?
Jul
1
comment Why do ATMs accept any PIN?
One minor side note, the PIN COULD be verified before hand and sent again with transaction amount, but this would require more communication. It isn't like sending the encrypted PIN once prevents being able to send the PIN + transaction amount later. It still makes sense not to though as it makes it take longer to execute an attempt if they have to go through setting up the transaction as well.
Jul
1
comment Best approach for storing banking information
I'm a little confused when you talk about hashing the bank details. That won't allow retrieval of the details so it doesn't make a whole lot of point in storing them. PBKDF2 uses a hash of the password the user inputs to generate an encryption key, it doesn't hash the actual data being stored. The salt that was used with the user's password to generate the key has to be kept, but it doesn't have to be associated with the data necessarily.
Jun
28
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@kjo that can still be emulated unless the key is protected. This is the idea behind an hsm, but such things aren't cheap or easy to work with.
Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
@skytreader - is it bad that I'm scared to click the link? Edit: Apparently not.
Jun
27
comment Accessing Chrome and Gmail on a stolen drive
Yes. They could clone your session unless it was IP locked.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@kjo - the decoded value has to be something that the application can recognize as valid too if it is all that it has to go on. If it isn't recognizable, then the login process won't know right from wrong either. The attacker can use the same approach.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@AviD - fair point, is "Reasonably often" more agreeable with reality?
Jun
24
comment How to sync with multiple authentication services?
I'm not even sure such a thing exists. It should be able to since LDAP just needs to be able to have a directory and it should be possible to build a directory off of accounts on other services, but I have never gone digging for such a thing before. That's why I only commented.
Jun
23
comment How to sync with multiple authentication services?
It doesn't necessarily have to be single sign on, but you need an LDAP service that is able to check multiple types of authentication and return the proper results.
Jun
23
comment Crack Unknown Encryption
@SQB - If it wasn't too broad, it would probably be on topic there. But this question is an entire field of study, not a Q/A topic. "How do I break generic encryption?" takes multiple text books and college classes, not a several paragraph answer.
Jun
23
comment Crack Unknown Encryption
@SQB - it is too long to be a GUID. It is not a good question for SE or Crypto. It is too broad to discuss general decryption of an unknown algorithm and is off topic on either site. It does appear that it is an identifying token rather than an encrypted message though from those search results.