Reputation
1,699
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 10
Newest
 Editor
Impact
~100k people reached

  • 0 posts edited
  • 0 helpful flags
  • 55 votes cast
Jan
21
comment Is it possible to secretly monitor/backdoor hardware?
Not only possible, has been attempted by governments (see for example en.wikipedia.org/wiki/Clipper_chip) and in some cases, governments have banned hardware from some sources due to fears either the hardware, firmware or software is somehow compromised (see popsci.com.au/make/hacks/…). I imagine that if you could inject a doddgy random number generator into a supply chain which has predictable generation properties, game over.
Dec
10
awarded  Editor
Dec
10
revised Can client-side hashing improve after-the-fact security in response to password leaks?
Updated based on additional info in comment
Dec
5
answered Can client-side hashing improve after-the-fact security in response to password leaks?
Dec
4
comment How does correct grammar affect password security?
@Ben We have to accept that passwords are fundamentally broken as a concept. The best we can do is hope we stay just in front of the current techniques and where possible, use things like 2FA. However, I think your statement that you can apply the technique in a few hours is for now overstated. As the article you cite points out, generating effective phrase lists is complex and time consuming and often requires using social eng. techniques to reduce the search space. This will change as pre-compiled phrase lists become more readily available, but for now it is a reasonable technique
Nov
24
comment LastPass - Best practices on foreign devices
@scott That will all depend on whether is is real 2FA or just the very common 2 step authentication which many 'sell' as 2FA. For example, recent hacks of google accounts which use 2 step authentication involving a code sent via SMS show the weakness of this approach. Because it does not rely on what you have (the phone) but on the number associated with the phone, a little social engineering of the provider and redirecting the number to a different phone and the 2 step authentication is bypassed
Nov
19
answered Two passwords provide better security than two-factor authentication?
Nov
14
awarded  Necromancer
Nov
12
comment Why is it possible for the root user to delete the logs?
@njzk2 bash history (and shell history generally) is trivial to beat. Most shells only write the history back to a file on exit. If you do a 'ard kill' of the shell, such as kill -9, it will exit without writing the history file. For a more secure history, you need something like kernel level process accounting, but that can dome at a performance cost
Oct
31
awarded  Custodian
Oct
31
reviewed Reviewed What is Reflected XSS?
Oct
30
awarded  Revival
Oct
30
answered How does correct grammar affect password security?
Oct
29
answered Should I have special emoticon handling for compliance, audit and logging?
Oct
24
answered How to check if iCloud password popup is legitimate?
Oct
22
answered REST Services: Limiting the concurrency of a login endpoint
Oct
16
comment Privacy issues when mobile app has access to phone number and contacts
In theory yes, in practice I don't think so. Theoretically, there are open source messaging apps, so you could analyse what they do and verify they are trustworthy. However, this is not practical and few have the necessary skills. I think you are still trusting in RSA and its implementations - that trust might be strong and based on good info, but it is still trust and may be misplaced (consider this weeks news about the NSA and DH, which highlights the issues of theory and implementation differences).
Oct
16
comment Mitigate timing attack threat against password recovery page
The exiisting answer uses timestamps and tracking of the time passed and adds a delay, effectively removing the situation where there is a response difference between successful and unsuccessful reset requests. My suggestion is to simply respond immediately with no difference between successful and unsuccessful requests. You then deal with sending (or not) the email as a separate async task
Oct
15
answered Mitigate timing attack threat against password recovery page
Oct
15
answered Privacy issues when mobile app has access to phone number and contacts