AJ Henderson

10,669 reputation

1834

bio	website
	location	Troy, NY
	age	28
visits	member for	8 months
	seen	8 mins ago
stats	profile views	312

	10,669 reputation	bio	website		visits	member for	8 months
1834 badges		location	Troy, NY		seen	8 mins ago

summary answers questions tags badges favorites bounties reputation activity

477 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 29	comment	Questions to hybrid encryption. RSA with AES @DeerHunter - it isn't really roll your own since he's using established algorithms. You don't want to roll your own algorithms. Using your own arrangement of algorithms is a fairly common and healthy practice as long as you understand what each algorithm provides.
Mar 28	comment	Email instead of username @GregorPetrin - I agree, that's why I mentioned the SMS system, though any alternate contact means would work. There are existing systems that will let you send messages to SMS for what I think it reasonably cheap. Maybe even free for lower volume.
Mar 27	comment	Why on earth would anyone use the 'top secret' option of IPv4? @Xander - I believe you are correct that they are actually all air gapped. I just remember hearing about the flag back in college and remembering it was in there for classifying data that would be impossible for the router to otherwise decide what to do with. They may have never used it or may not use it anymore. I'm not sure about actual usage, just the intent.
Mar 27	comment	Are these standard OAuth2 flows? (what are their names?) Welcome to IT Security on StackExchange. Thanks for clearly indicating your affiliation and providing an answer that provides more than just the link. I wish all vendor posts could be as well done.
Mar 27	comment	Was WPS fixed (wifi)? My guess is the downvotes are because there does not seem to be any support that such a rumor exists, however the question is still valid and the answer appears to be "no, there is nothing making it so that it is no longer broken." It's still a perfectly valid question though. I gave it a +1.
Mar 27	comment	Email instead of username @Saladin - I think adding some magic value would counteract the intended purpose to have the account be easily remembered and globally unique. Hiding the original is desirable, but can't really be done without counteracting the reason for using it in the first place.
Mar 27	comment	Email instead of username Isn't coupling the username to the method of emergency contact bad (in the real world where people reuse passwords) since it makes it an unreliable means of emergency contact when a compromise occurs?
Mar 27	comment	Email instead of username @Luc - right, it isn't that it would make more people use the same password. It is that if the e-mail is disclosed to someone who has compromised an account, then the e-mail can not be reliably used for account recovery. Ie, I have an account abc@123.com. I use the same password for my e-mail. My account get's compromised and I go to try and recover it. How do you verify it is me? Well, you could send me an e-mail, but since the attacker knows my e-mail, he can take over my e-mail as well. It's safer to have a decoupled (side channel) means to connect with a user.
Mar 27	comment	Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer ah, ok, so that is more or less fitting with my b) scenario. I guess that works ok since it still ensures the card is present and can't be reproduced without the card and the pin to unlock the card isn't around. Alright, I just had to finish thinking it through.
Mar 27	comment	Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer the point of that device is Payment capture. It is either a) communicating the payment information directly to the payment gateway (thus bypassing the computer completely), b) being given a transaction to sign and signing it or c) passing the payment information after unlock. I suppose that authentication could be accomplished by doing a challenge/response signing, but it would open the door for something other than the login to provide the challenge.
Mar 27	comment	Keyboards with built in SmartCard reader. PIN/Password to unlock not via Computer This would be difficult to implement to be more secure than doing it on a computer itself. How does the keyboard transmit the all clear to the computer? What prevents this signal from being cloned? I suppose it might be possible to use the keyboard to directly unlock the card and then have the card handle the connection, but it sounds like it would be pretty difficult to setup and might introduce risks about attacks convincing a smart card to authenticate something you didn't want to authenticate (since it is unlocked by different hardware than it is authenticating to).
Mar 27	comment	Giving privilege with validity in Windows 7 @Maximin - it might be possible to have a third party application that would automatically close forbidden programs at certain times, but it would be an entirely third party system outside of what security is provided by Windows. I have no idea if such a product exists.
Mar 22	comment	Does PGP key I created and uploaded have any legal value? they still wouldn't be valid in your locality. Local laws differ greatly and in some places there isn't even clear laws about it. Any general stories someone would have have no legal barring on your situation.
Mar 22	comment	Does PGP key I created and uploaded have any legal value? Questions of legality can't really be answered on a Q/A site. It's dependent on your local laws and would really require that a lawyer advise you on the answer to the question. Some jurisdictions do attribute legal meaning to signatures, but there are also technical issues in terms of proving you are the private key holder.
Mar 22	comment	What asymetric scheme provides the shortest signature, while being secure? @Wam - Replay would be a problem then. A OTP system only works if you know that the code has not been used before. Say that you want to prove you hold the key to Billy Bob, but I pretend to be Billy Bob and ask you for a OTP token. You give me your token, then I can turn around and give the token to Billy Bob and say I'm you. Without being able to ensure there is no reuse. You would need an entire negotiation protocol to ensure trust and would need something like SSL. You aren't going to be able to do that securely with a shortened OTP.
Mar 22	comment	Is it safer to design websites and servers with HTML5 rather than flash? @yzT It is true that HTML5 is gaining on Flash, particularly since Flash stopped supporting Mobile platforms, but it doesn't really have anything do do with the safety (security wise) of designing a site for either.
Mar 22	comment	What asymetric scheme provides the shortest signature, while being secure? @Wam - ok, you'll need to explain a little more about how you are planning to use a signature in a one time password thing. Typically one time passwords are derived from encrypting a timestamp or some other constantly incrementing value and then that value is only valid for a particular time. There is no particular interest in faking one (altering the timestamp while still getting the same one time password), so collisions are not a concern.
Mar 21	comment	How easy is it to find a password in a huge text file? @Peter - generally for purposes of attacking an algorithm, you should assume that the algorithm is known. If there are always two parts, assume the attacker knows that.
Mar 21	comment	How easy is it to find a password in a huge text file? However, since we have a pattern in the system, it isn't truly random so real world performance would be even lower. Having a part from your head is irrelevant as it would be an extension of the length and would be identical for either the un-stored entropy or the stored system.
Mar 21	comment	How easy is it to find a password in a huge text file? attempts to exhaustively try all possibilities. We can then take that number and compare it to the number of brute force tries required for the password of that same length (number of possible values for each character to the power of however many characters we have). If the number of possibilities in the storage system is lower, then we have a reduction of entropy even if the system is perfectly random.