280 reputation
111
bio website
location Alphen aan Den Rijn, The Netherlands
age 53
visits member for 1 year, 10 months
seen 59 mins ago

Software developer at TimeTell BV, The Netherlands


Jun
25
comment Convincing my manager to use salts
A list of blog posts about the frequency distribution of common passwords might help convince him. Or posts about the consequences of not using salts, like this recent one: nakedsecurity.sophos.com/2014/06/24/… Although I doubt that only this will turn him over (see the remarks in Tom Leek's answer).
Jun
14
comment Securing data at rest
What are you defending against? If it's the entire world, your question is too broad.
Jun
13
comment How can Facebook use history data in browser
@Vineet This is not about liked pages. Just the button being displayed in the browser is enough.
Jun
13
comment How can Facebook use history data in browser
BTW As a web site owner you can do something about this
Apr
18
comment What security mechanisms are used in BGP and why do they fail?
There are some comments about BGP security in episode 432 of Security Now (grc.com/securitynow.htm; transcripts available). What Steve was saying in that episode is 'we should do an episode on BGP', but that has not happened yet (latest is 451). Maybe it's worth keeping an eye on the podcast.
Apr
5
comment Is Telegram secure?
Yes, Threema is 'trust no one': they don't have the keys so they cannot decrypt your messages. It costs $2 IIRC. Threema also does authentication on several levels, the strongest being that if you exchange QR code between phone displays, you know from that moment on that you are communication with that phone ('person' would be incorrect, someone could have stolen your contacts' phone).
Mar
21
comment Should I reject obviously poor passwords?
Can I upvote this answer twice? The second time for "Second, you want to educate users on what a weak password is"
Mar
21
comment How do I allow websites to call my desktop app over HTTPS?
"The kicker is the app is open-source, so I'll have to distribute the certificate/key to all the clients." No you don't. You leave it to the users to get their own certificate. You just describe to them how to implement it. We have exactly the same situation (although not open source): the user can connect to our software hosted by us with our certificate, or he can host everything himself but then he'll have to get his own cert and use that. (security.stackexchange.com/questions/52654/…)
Mar
6
comment Risks associated with distributing encrypted private key with our software?
Thank you. It turns out that my question was a bit premature: those .pem files are in our development tree (and repository) and we use them when deploying on hosted machines administrated by us. We also distribute the software to clients who can do their own hosting if they want to, but in that distribution no .pem files are included.
Mar
4
comment Is it bad practice to add an encrypted private key to source control?
Unless I wanted to spoof someone else?
Dec
19
comment RSA key recovery using sound - How does it work?
Abstract here: nakedsecurity.sophos.com/2013/12/19/the-sound-made-by-your-computer-could-give-a‌​way-your-encryption-keys/
Nov
29
comment What to do when I found a spyware that my spouse has installed?
-1 For an answer essentially escalating the problem.
Sep
10
comment How to generete dictionary for brute force attack?
1. Can you program? 2. What is the password for, i.e. how will you know when you have found the correct one?
Aug
30
comment What is “download-new.com”?
If you Google "is this website safe" you find many reputation checkers like safeweb.norton.com or secureurlchecker.appspot.com where you can enter the suspect URL. Read the results carefully - i.e. how these websites come to their safe/unsafe conclusions.
Aug
30
comment What is “download-new.com”?
The fact that your search results are different doesn't say much nowadays. Google tailors search results to your geographical location and search history.
Jun
11
comment Is there a true alternative to using CAPTCHA images?
There's always Crapcha (crapcha.com). Sorry, couldn't resists
May
23
comment Best source(s) for security related news?
Yeah, I should clean 'm out...
May
17
comment What can an attacker do with Bluetooth and how should it be mitigated?
BlueTooth security is explained in Episode 280 of Security Now grc.com/sn/past/2010.htm I'm not going to copy/paste from their transcript to a SE answer. As far as I remember from that episode you can take some measures but Bluetooth is crackable. Also, Bluetooth implementations differ because the specs are ambiguous, which leaves room for exploits (Maybe after all the years of its implementation, developers have converged to a practical standard, I don't know)
May
17
comment Finding spam sending scripts?
Are you afraid that you have 'email spam sending scripts' on your server? If your server is compromised you're wasting time. Reformat and reinstall from backup. That's the only sensible solution, you'll never be able to track down and erase the malware to a point where you can guarantee that your server is clean again.
May
10
comment Overwriting hard drive to securely delete a file?
Your question is not entire clear and this makes answering it too broad: Did you install software or did you just copy some (data) files onto the machine, or created them? Please edit.