27,133 reputation
22661
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 2 hours ago

May
18
comment Can a certification authority sign another CA's certs?
@diti all that matters is chain of authority. If the signatures chain back to a trusted cert then it will be trusted. The only time there would be some variability is that some programs don't check valid subjects to be signed if there are some restrictions on the cert.
May
16
comment Challenge-response login without storing a password equivalent
ah, yeah, looks like unix style systems tend to do it just because people may have a tendency to use the same password in multiple places and because the user-login locally still requires the real password. So they are trying to avoid allowing local login even if the network authentication itself would be fubar. Still a weak case in my opinion, but at least I understand the reasoning now.
May
16
comment Challenge-response login without storing a password equivalent
yeah, I was just trying to understand the question because the use of a hash to generate the secret from the password serves no purpose. It doesn't answer your question (which is why I commented), it was just something that didn't make sense to me.
May
16
comment Challenge-response login without storing a password equivalent
why does the server bother storing a hash rather than the actual secret then? The hash serves no purpose other than to increase the time it takes to authenticate. A challenge response should be hash(challenge + secret + salt). I guess that your question is if there is a way to do it without having to store the secret on the server though right? (since the normal algorithm still requires storing the secret used by the user.)
May
16
comment Challenge-response login without storing a password equivalent
How do they directly use the hash to login? If they provide the hash, the server will try salting and hashing the hash, get a different value than what it has stored and fail the authentication.
May
15
comment SSL encryption work only in content?
@DouglasLeeder - wasn't aware of that, thanks for the heads up. Updated the answer accordingly.
May
15
comment Which is considered the first Cyber Security incident?
The problem with this question is how do you define what was actually a "menace"? Early viruses and such were primarily "what can we do" type of things that progressively got more profit oriented as things moved in to wider use. Defining when that switch occurred from pranks and "can we do this" to "lets try to cause harm for fun or profit" is highly subjective at best.
May
13
comment Can a certification authority sign another CA's certs?
@LarryK - thanks for pointing that out. That is why I said "to the best of my knowledge" since I hadn't particularly gone looking, but I knew most didn't. I have updated my answer accordingly. Please let me know if you think there are any additional changes that would improve it or feel free to suggest an edit to the answer.
May
12
comment Public Key Authentication
Phone call isn't a trusted third party if you know their voice. Similarly, depending on what you are trying to authenticate, something like a facebook login wouldn't be a trusted third party, so long as all you want to know is that they have control of that account.
May
12
comment Public Key Authentication
@Michael - it depends on the situation. Possibly via a phone call, possibly via a notary public, possibly via sending a courier and/or driving to the other person yourself, possibly a facebook login, possibly something else entirely. It really depends on the level of security needed. PKI makes life easier, but it isn't a necessity, especially for small situations.
May
9
comment What can happen if someone gets a hold of a scan of someone else's passport?
@MatthewPeters - while it does say IT Information Security as the official title, we generally end up covering a wide range of info sec topics. It's really more or less just an outdated title since it isn't really a practical distinction. Info sec is info sec whether IT related or general. If someone can get your passport info and use it to impersonate you, then that may have repercussions anywhere, including IT.
May
5
comment How does police or somebody find out that an Arp Spoofing attack was done?
Andrea - logs could be anywhere, they could be nowhere. It all depends on the configuration of the environment and what hardware was actually involved. Different devices are configured with different levels of logging and may or may not have captured the details needed. Piecing it all together is a very non-trivial task.
May
5
comment Box web application security review - legality?
@Peteris - a lot of that is the same in the US. Just because a term is in the EULA doesn't mean it is enforceable. That's why I specified "as far as it is enforceable."
May
2
comment Finding the firewall port that filters internet traffic
@schroeder - while the move to close is still valid, it is worth highlighting that circumventing the security of a system is only off topic if they don't have a basic understanding of how to do so. If they understand the concepts involved and are looking for clarification on some aspect of it, it is on topic. (For example for penetration testing.) This situation is still off topic though.
May
2
comment Multi user symmetric key encryption
let us continue this discussion in chat
May
2
comment Multi user symmetric key encryption
You can do the same thing with groups if you want by giving a group its own public/private keypair and then adding the private key for the group (encrypted with the user's public key) to each group member's keyring.
May
2
comment Multi user symmetric key encryption
That's why you use symmetric content encryption keys and share the key. The server keeps one copy of the file, encrypted symmetrically with a content encryption key. You don't make multiple copies of the file, you make multiple copies of the key. So say I want to share file Foo with Alice and Bob. I encrypt Foo with a new FooContentKey. I encrypt FooContentKey with Alice's public key and put the new FooContentKeyForAlice on Alice's keyring. I then encrypt FooContentKey with Bob's public key and put it on Bob's keyring as FooContentKeyForBob.
May
2
comment Multi user symmetric key encryption
@KevinOpdenKamp - For a multi-user system, you need asymmetric cryptography unless both users are involved in encrypting the file. You use symmetric cryptography for encrypting data, you use asymmetric for exchanging keys with another user. In theory, if both users were online, you could have one user give the data key to the other and have them then encrypt it so only they can access it, but there is no secure way to save a content encryption key for another user with symmetric cryptography if the system doesn't have access to that user's key, which defeats the whole point of encryption.
May
2
comment Multi user symmetric key encryption
So when a new user is created, you generate a public/private key pair. Store the public key on the user's record, use the user's password with a KDF (key derivation function) to produce an encryption key, use that key to encrypt the private key and store that on the user's record as well. From there, the public key can be used to encrypt any content keys that the user needs to have access to and the system can use the user's password on login to load their private key in to the session, thus making it so their keyring can be opened.
May
2
comment Multi user symmetric key encryption
@KevinOpdenKamp - I suggest you read up on asymmetric cryptography. From your comment it sounds like you have some very basic misunderstandings. I was disagreeing with you as I understood what you were saying. Yes, the public key would be stored with the user's record, but it would need to be part of a cryptographically generated keypair. With asymmetric cryptography, the public key can be used to encrypt something such that only the private key can decrypt it.