500 reputation
212
bio website
location Alphen aan Den Rijn, The Netherlands
age 54
visits member for 2 years, 6 months
seen yesterday

Software developer at TimeTell BV, The Netherlands


1d
comment Why is my Positive SSL certificate deemed insecure by Google Chrome?
Actually, there is nothing wrong with SHA-1 certificates yet. Google decided to pre-emptively build this into Chrome. It would've been the smart move to start these warnings for the same cutoff date as Microsoft does (1 January 2017), but these two are not the best of friends it seems.
Feb
6
comment I can't access websites that use HTTPS, instead getting the message “your connection is not private”!
Could also be that the ISP wants to inject Javascript into all traffic instead of just HTTP, for tracking and advertising purposes. ISP in the US are doing that. Just as bad IMHO
Jan
6
comment Is forcing users to use a strong password effective?
Your scheme would prevent me from using a stronger password than what you sypply (e.g. a 20 char generated Lastpass password). You would receive a strongly worded email if I was one of your users.
Dec
31
comment Does cynicism have a valid role in information security?
"to always assume that the credentials have been compromised" is not cynicism (check the dictionary). I suggest you edit your question and use a different term. Paranoia maybe?
Dec
18
comment Things to remember while building a password manager
Download and read about the ones that already exists, like KeepPass or Password Safe
Nov
27
comment Using unique email address for online signups?
A technique that people sometimes use in order to have not too many (to remember/store) email addresses: use separate addresses for important logins, use one for the many other less important sites (forums, blogs...)
Nov
15
comment Is SHA1 weak for SSL?
Extended discussion about the Google move in Security Now ep. 473 grc.com/securitynow.htm
Oct
29
comment Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method
You can make that an answer (answer your own question) - then it is more obvious to others that there is an answer. You can even mark it as the correct answer after 48 hours.
Sep
17
comment Security of a Random Password
@Curious I get the impression that you have asked this answer only to get confirmation for your assumption (that a 15-char random PW is good enough) instead of really understanding the comments and answers. NO, there are circumstances where it's not good enough. 'In case of database breach' depends very much on how well that DB stored the PWs. Actually, there are so many different scenarios that your question could be seen as 'too broad'.
Sep
14
comment Tiny USB sticks
Why not fill an ordinary USB stick with plain text files that cannot be infected, leaving only a kilobyte? It's highly unlikely that a virus will make room for itself by deleting files. Maybe that leaves the possibility of a boot sector infection, I dunno (does a USB stick have one?)
Aug
25
comment Brute force alphanumeric password using JohnTheRipper
I remember doing this yeeeeeaaaars ago with a very simple Turbo Pascal program I wrote that called unzip with each possible password. Maybe that's an option, just add some logging and the next morning you have your hit.
Aug
17
comment Why do we use such a redundant language (English) for network communication?
This question comes from an incorrect viewpoint. You are talking as if the encryption algoritm has a preference for English (or any natural language for that matter). It does not, we do. So we compress English. To put it another way: your question text "we use English for network communications" is incorrect.
Aug
11
comment Sophos virus protection continuously blocking codegv.ru
It is indeed a suspect site. According to ScanUrl.net the site codegv.ru has a negative reputation at Web of Trust(WOT). And McAfee SiteAdvisor reports it as a spam URL. And there are reports about hacked Ukrainian sites having scripts linking to codegv.ru
Aug
11
comment Why must every OTP be unique
'Per user' I assume? Your post does not say so explicitly.
Aug
6
comment Appropriate response to 2014 Russian Security Breach (CyberVor)
Not much hard data in there, just generic statements. Looks like they assembled a database.
Aug
3
comment Antivirus settings: delete or quarantine the file?
@Jay No. You have no advantage removing them immediately. They don't do any harm in quarantine. And you still have the optional disadvantage I described. 'Home user' is too broad a definition. There are e.g. utilities you may want to download that trigger the AV. Not often, but I had them.
Jun
25
comment Convincing my manager to use salts
A list of blog posts about the frequency distribution of common passwords might help convince him. Or posts about the consequences of not using salts, like this recent one: nakedsecurity.sophos.com/2014/06/24/… Although I doubt that only this will turn him over (see the remarks in Tom Leek's answer).
Jun
14
comment Securing data at rest
What are you defending against? If it's the entire world, your question is too broad.
Jun
13
comment How can Facebook use history data in browser
@Vineet This is not about liked pages. Just the button being displayed in the browser is enough.
Jun
13
comment How can Facebook use history data in browser
BTW As a web site owner you can do something about this