406 reputation
bio website
location Alphen aan Den Rijn, The Netherlands
age 53
visits member for 1 year, 10 months
seen yesterday

Software developer at TimeTell BV, The Netherlands

comment Brute force alphanumeric password using JohnTheRipper
I remember doing this yeeeeeaaaars ago with a very simple Turbo Pascal program I wrote that called unzip with each possible password. Maybe that's an option, just add some logging and the next morning you have your hit.
comment Why do we use such a redundant language (English) for network communication?
This question comes from an incorrect viewpoint. You are talking as if the encryption algoritm has a preference for English (or any natural language for that matter). It does not, we do. So we compress English. To put it another way: your question text "we use English for network communications" is incorrect.
comment Sophos virus protection continuously blocking codegv.ru
It is indeed a suspect site. According to ScanUrl.net the site codegv.ru has a negative reputation at Web of Trust(WOT). And McAfee SiteAdvisor reports it as a spam URL. And there are reports about hacked Ukrainian sites having scripts linking to codegv.ru
comment Why must every OTP be unique
'Per user' I assume? Your post does not say so explicitly.
comment Appropriate response to 2014 Russian Security Breach (CyberVor)
Not much hard data in there, just generic statements. Looks like they assembled a database.
comment Antivirus settings: delete or quarantine the file?
@Jay No. You have no advantage removing them immediately. They don't do any harm in quarantine. And you still have the optional disadvantage I described. 'Home user' is too broad a definition. There are e.g. utilities you may want to download that trigger the AV. Not often, but I had them.
comment Convincing my manager to use salts
A list of blog posts about the frequency distribution of common passwords might help convince him. Or posts about the consequences of not using salts, like this recent one: nakedsecurity.sophos.com/2014/06/24/… Although I doubt that only this will turn him over (see the remarks in Tom Leek's answer).
comment Securing data at rest
What are you defending against? If it's the entire world, your question is too broad.
comment How can Facebook use history data in browser
@Vineet This is not about liked pages. Just the button being displayed in the browser is enough.
comment How can Facebook use history data in browser
BTW As a web site owner you can do something about this
comment What security mechanisms are used in BGP and why do they fail?
There are some comments about BGP security in episode 432 of Security Now (grc.com/securitynow.htm; transcripts available). What Steve was saying in that episode is 'we should do an episode on BGP', but that has not happened yet (latest is 451). Maybe it's worth keeping an eye on the podcast.
comment Is Telegram secure?
Yes, Threema is 'trust no one': they don't have the keys so they cannot decrypt your messages. It costs $2 IIRC. Threema also does authentication on several levels, the strongest being that if you exchange QR code between phone displays, you know from that moment on that you are communication with that phone ('person' would be incorrect, someone could have stolen your contacts' phone).
comment Should I reject obviously poor passwords?
Can I upvote this answer twice? The second time for "Second, you want to educate users on what a weak password is"
comment How do I allow websites to call my desktop app over HTTPS?
"The kicker is the app is open-source, so I'll have to distribute the certificate/key to all the clients." No you don't. You leave it to the users to get their own certificate. You just describe to them how to implement it. We have exactly the same situation (although not open source): the user can connect to our software hosted by us with our certificate, or he can host everything himself but then he'll have to get his own cert and use that. (security.stackexchange.com/questions/52654/…)
comment Risks associated with distributing encrypted private key with our software?
Thank you. It turns out that my question was a bit premature: those .pem files are in our development tree (and repository) and we use them when deploying on hosted machines administrated by us. We also distribute the software to clients who can do their own hosting if they want to, but in that distribution no .pem files are included.
comment Is it bad practice to add an encrypted private key to source control?
Unless I wanted to spoof someone else?
comment RSA key recovery using sound - How does it work?
Abstract here: nakedsecurity.sophos.com/2013/12/19/the-sound-made-by-your-computer-could-give-a‌​way-your-encryption-keys/
comment What to do when I found a spyware that my spouse has installed?
-1 For an answer essentially escalating the problem.
comment How to generete dictionary for brute force attack?
1. Can you program? 2. What is the password for, i.e. how will you know when you have found the correct one?
comment What is “download-new.com”?
If you Google "is this website safe" you find many reputation checkers like safeweb.norton.com or secureurlchecker.appspot.com where you can enter the suspect URL. Read the results carefully - i.e. how these websites come to their safe/unsafe conclusions.