258 reputation
19
bio website
location Alphen aan Den Rijn, The Netherlands
age 53
visits member for 1 years, 6 months
seen yesterday

Software developer at TimeTell BV, The Netherlands


Apr
18
comment What security mechanisms are used in BGP and why do they fail?
There are some comments about BGP security in episode 432 of Security Now (grc.com/securitynow.htm; transcripts available). What Steve was saying in that episode is 'we should do an episode on BGP', but that has not happened yet (latest is 451). Maybe it's worth keeping an eye on the podcast.
Apr
5
comment Is Telegram secure?
Yes, Threema is 'trust no one': they don't have the keys so they cannot decrypt your messages. It costs $2 IIRC. Threema also does authentication on several levels, the strongest being that if you exchange QR code between phone displays, you know from that moment on that you are communication with that phone ('person' would be incorrect, someone could have stolen your contacts' phone).
Apr
4
revised Proving SSL need
general cleanup
Apr
4
suggested suggested edit on Proving SSL need
Mar
21
comment Should I reject obviously poor passwords?
Can I upvote this answer twice? The second time for "Second, you want to educate users on what a weak password is"
Mar
21
comment How do I allow websites to call my desktop app over HTTPS?
"The kicker is the app is open-source, so I'll have to distribute the certificate/key to all the clients." No you don't. You leave it to the users to get their own certificate. You just describe to them how to implement it. We have exactly the same situation (although not open source): the user can connect to our software hosted by us with our certificate, or he can host everything himself but then he'll have to get his own cert and use that. (security.stackexchange.com/questions/52654/…)
Mar
6
awarded  Student
Mar
6
awarded  Scholar
Mar
6
accepted Risks associated with distributing encrypted private key with our software?
Mar
6
comment Risks associated with distributing encrypted private key with our software?
Thank you. It turns out that my question was a bit premature: those .pem files are in our development tree (and repository) and we use them when deploying on hosted machines administrated by us. We also distribute the software to clients who can do their own hosting if they want to, but in that distribution no .pem files are included.
Mar
4
asked Risks associated with distributing encrypted private key with our software?
Mar
4
comment Is it bad practice to add an encrypted private key to source control?
Unless I wanted to spoof someone else?
Dec
19
comment RSA key recovery using sound - How does it work?
Abstract here: nakedsecurity.sophos.com/2013/12/19/the-sound-made-by-your-computer-could-give-a‌​way-your-encryption-keys/
Dec
16
answered A firewall without any extra features
Nov
29
comment What to do when I found a spyware that my spouse has installed?
-1 For an answer essentially escalating the problem.
Oct
22
revised How can I detect that steganography has been used?
Rewrote for clarity, esp title
Oct
22
suggested suggested edit on How can I detect that steganography has been used?
Oct
3
awarded  Yearling
Sep
16
answered Random File downloaded
Sep
10
comment How to generete dictionary for brute force attack?
1. Can you program? 2. What is the password for, i.e. how will you know when you have found the correct one?