28,015 reputation
22766
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 11 hours ago

May
22
comment How does forensic software detect deleted files
@MatthewPeters - right, the only way to be sure is to actually destroy the data. It might be enough, but there may be something in the file format (or it may have simply used a contiguous block) that may let it be recovered still. Getting rid of the pointers MAY prevent recovery, but it just as likely (if not more likely) may not.
May
22
comment How does forensic software detect deleted files
@user46850 - not necessarily. Some file systems also put forward or forward and reverse pointers at the beginning of each block of clusters used. It depends on the file system. It also depends on the file format and if there is anything that will help piece clusters together even if they aren't linked to each other.
May
22
comment How does forensic software detect deleted files
I forget if it is the MFT or actually at the end of each cluster, but yes, there is a linked list that ties the clusters used in a file together in many file systems. The exact mechanisms vary by file system.
May
22
comment I want a full time career in the field of security. The following is my plan. Any suggestions or modifications?
Perhaps a better initial question is how is the work not what you expected and what do you expect? If we don't know what you expect, then we don't know what will prepare you for it, or if a job doing what you expected to be doing even exists.
May
21
comment what are security flaws on providing access to users through a unlisted/private/token/signed URL?
@jibiel - Assuming you are talking about the ID, I simply mean that you want to make sure that the system is resistant to guessing if the URLs should only be used by one particular person. If you make it some long random value, people can guess forever and maybe find one. If you make it a unique ID (which is public) and a random access code (which is quasi-secret), then you can disable the unique ID if the code is wrong more than a couple times. This helps prevents random guessing.
May
21
comment what are security flaws on providing access to users through a unlisted/private/token/signed URL?
For your third point, I'm not sure what you mean by the system I'm proposing. I wasn't proposing any system, I was observing about what I understood of what you suggested. I only suggested that it seems like much of the same thing could be done with a non-secured public site that is openly shared.
May
21
comment what are security flaws on providing access to users through a unlisted/private/token/signed URL?
@jibiel - there seem to be some misunderstandings, for your first point, why is sending a URL necessary in the first place? Why can they not simply connect to the site and fill out a public page. What are you gaining by obfuscating it with a token? For the second point, it might not be. You were the one asking about potential security issues. I was simply pointing out that a low degree of randomness in the URL means that someone other than the person the link was sent to may be able to access it. That may not be a problem depending on your scenario.
May
21
comment How to compare encrypted private keys?
Or one used excessive padding just to be a pain. Don't know if anything allows padding an entire block or not, but there isn't any reason it couldn't theoretically be done if someone was trying to avoid same length.
May
21
comment How to secure ubuntu desktop after a hack?
you still aren't understanding. It doesn't matter if the attacker is out now. If the computer is in use, then encryption doesn't keep an attacker out. It just prevents accessing the system when it is not operating (which having the system turned off generally does a pretty good job too for remote attackers like this question is talking about). Encryption is a mechanism to protect data theft at rest, not intrusion.
May
20
comment How can I convince my communication partner to use encryption in everyday life?
@lornzog - fair point, ok, you got my +1 vote back.
May
20
comment How can I convince my communication partner to use encryption in everyday life?
Heartbleed wasn't an algorithmic mistake though. Algorithmic mistakes are a math thing as they result in a math related vulnerability (ie, a reduction in randomness, due to a mistake in math). This is the only kind of vulnerability relevant to a process occurring entirely outside the scope of the transmission. Heartbleed impacts clients in an online communication, it doesn't impact client side software that doesn't interact with anything. If the client machine itself is compromised (necessary to attack the encryption software) then they can get the message before it is encrypted anyway.
May
20
comment How can I identify which computers a USB device has been used on?
And even if they do, it could be spoofed.
May
20
comment How can I convince my communication partner to use encryption in everyday life?
I initially upvoted, but then I removed it when I got to the part about shifting the security to the software. For active systems that's true, but for something where you are encrypting data at rest, the software doesn't have much to do with it since the software isn't available to the attacker in a state where it can decrypt the e-mail. If they screwed up the algorithm implementation, it might result in a weakness in the encryption itself, but that's a math thing rather than a software thing. Heartbleed like issues are basically irrelevant to client side e-mail encryption.
May
20
comment How can I convince my communication partner to use encryption in everyday life?
One minor note, there are PGP capable mail clients for Android, but they have to be your entire mail client generally, which makes them kind of limiting since they tend to not be the greatest mail client. Some can also work using the share with feature, but it still isn't particularly clean.
May
19
comment Is it secure to use *no authentication* for services listening only on localhost?
@Joshua - yes, the TCP thing was exactly my point, you can't establish a connection on TCP and can't get any responses on UDP, even should the host accept it in error.
May
19
comment Is it secure to use *no authentication* for services listening only on localhost?
@Joshua - are you sure that is true on all network cards and operating systems? Either way, my point is that it is irrelevant if it can or not.
May
19
comment How to secure ubuntu desktop after a hack?
This doesn't help against a compromise on a system in use. If the system is in use, the encryption keys are in memory and if the attacker can compromise the system, they then have access to the drives. This stops neither threat that the OP is asking about.
May
18
comment Can a certification authority sign another CA's certs?
@diti all that matters is chain of authority. If the signatures chain back to a trusted cert then it will be trusted. The only time there would be some variability is that some programs don't check valid subjects to be signed if there are some restrictions on the cert.
May
16
comment Challenge-response login without storing a password equivalent
ah, yeah, looks like unix style systems tend to do it just because people may have a tendency to use the same password in multiple places and because the user-login locally still requires the real password. So they are trying to avoid allowing local login even if the network authentication itself would be fubar. Still a weak case in my opinion, but at least I understand the reasoning now.
May
16
comment Challenge-response login without storing a password equivalent
yeah, I was just trying to understand the question because the use of a hash to generate the secret from the password serves no purpose. It doesn't answer your question (which is why I commented), it was just something that didn't make sense to me.