258 reputation
19
bio website
location Alphen aan Den Rijn, The Netherlands
age 53
visits member for 1 years, 6 months
seen 2 days ago

Software developer at TimeTell BV, The Netherlands


Apr
18
comment What security mechanisms are used in BGP and why do they fail?
There are some comments about BGP security in episode 432 of Security Now (grc.com/securitynow.htm; transcripts available). What Steve was saying in that episode is 'we should do an episode on BGP', but that has not happened yet (latest is 451). Maybe it's worth keeping an eye on the podcast.
Apr
5
comment Is Telegram secure?
Yes, Threema is 'trust no one': they don't have the keys so they cannot decrypt your messages. It costs $2 IIRC. Threema also does authentication on several levels, the strongest being that if you exchange QR code between phone displays, you know from that moment on that you are communication with that phone ('person' would be incorrect, someone could have stolen your contacts' phone).
Mar
21
comment Should I reject obviously poor passwords?
Can I upvote this answer twice? The second time for "Second, you want to educate users on what a weak password is"
Mar
21
comment How do I allow websites to call my desktop app over HTTPS?
"The kicker is the app is open-source, so I'll have to distribute the certificate/key to all the clients." No you don't. You leave it to the users to get their own certificate. You just describe to them how to implement it. We have exactly the same situation (although not open source): the user can connect to our software hosted by us with our certificate, or he can host everything himself but then he'll have to get his own cert and use that. (security.stackexchange.com/questions/52654/…)
Mar
6
comment Risks associated with distributing encrypted private key with our software?
Thank you. It turns out that my question was a bit premature: those .pem files are in our development tree (and repository) and we use them when deploying on hosted machines administrated by us. We also distribute the software to clients who can do their own hosting if they want to, but in that distribution no .pem files are included.
Mar
4
comment Is it bad practice to add an encrypted private key to source control?
Unless I wanted to spoof someone else?
Dec
19
comment RSA key recovery using sound - How does it work?
Abstract here: nakedsecurity.sophos.com/2013/12/19/the-sound-made-by-your-computer-could-give-a‌​way-your-encryption-keys/
Nov
29
comment What to do when I found a spyware that my spouse has installed?
-1 For an answer essentially escalating the problem.
Sep
10
comment How to generete dictionary for brute force attack?
1. Can you program? 2. What is the password for, i.e. how will you know when you have found the correct one?
Aug
30
comment What is “download-new.com”?
If you Google "is this website safe" you find many reputation checkers like safeweb.norton.com or secureurlchecker.appspot.com where you can enter the suspect URL. Read the results carefully - i.e. how these websites come to their safe/unsafe conclusions.
Aug
30
comment What is “download-new.com”?
The fact that your search results are different doesn't say much nowadays. Google tailors search results to your geographical location and search history.
Jun
11
comment Is there a true alternative to using CAPTCHA images?
There's always Crapcha (crapcha.com). Sorry, couldn't resists
May
23
comment Best source(s) for security related news?
Yeah, I should clean 'm out...
May
17
comment What can an attacker do with Bluetooth and how should it be mitigated?
BlueTooth security is explained in Episode 280 of Security Now grc.com/sn/past/2010.htm I'm not going to copy/paste from their transcript to a SE answer. As far as I remember from that episode you can take some measures but Bluetooth is crackable. Also, Bluetooth implementations differ because the specs are ambiguous, which leaves room for exploits (Maybe after all the years of its implementation, developers have converged to a practical standard, I don't know)
May
17
comment Finding spam sending scripts?
Are you afraid that you have 'email spam sending scripts' on your server? If your server is compromised you're wasting time. Reformat and reinstall from backup. That's the only sensible solution, you'll never be able to track down and erase the malware to a point where you can guarantee that your server is clean again.
May
10
comment Overwriting hard drive to securely delete a file?
Your question is not entire clear and this makes answering it too broad: Did you install software or did you just copy some (data) files onto the machine, or created them? Please edit.
May
10
comment Intel How Strong is Your Password page, good advice?
@Johnny Yes they do. Google 'Mat Honan'
May
7
comment How to encrypt data on the server?
+1 for thinking outside the box ("encryption shouldn't be your focus")
Apr
15
comment ISO27000 implementation - Where do you get the standardization material?
You'd have to buy them, but when I was involved in this two years ago I managed to find illegal copies just by Googling.
Apr
12
comment Is social-engineering an actual threat
Another recent example: Mat Honan wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking