Reputation
699
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 14
Newest
 Critic
Impact
~15k people reached

  • 0 posts edited
  • 0 helpful flags
  • 67 votes cast
Jan
18
comment How should I securely type a password in front of a lot of people?
@Kos physical access attack is more costly against disk encryption. Is it not? Then, consider something like coreboot (not prioprietrary which may contain bugs or backdoors already) one day help to protect your boot path. The costs would be rised again. Isn't it just a dogma?
Jan
18
comment How should I securely type a password in front of a lot of people?
You cannot unlock your disk encryption at boot time this way. Or simply imagine taking your laptop with you screen-locked to meet someone...
Jan
18
comment How should I securely type a password in front of a lot of people?
@QuoraFeans I'd highlight cameras. They're hard to escape. The key-loggers are hard to justify... However, cameras from 'security' to the 'smartglass' infiltrate venues previously neutral.
Oct
24
comment Where do you store your personal private GPG key?
As mentioned in another answer, this is very convenient, but you reduce the security of all items protected by your key to the passphrase. You also... as zigg pointed out in a comment
Oct
24
comment Where do you store your personal private GPG key?
what does JavaScript supposed to mean here? if it's a joke I think this is the wrong time to make jokes...
Sep
7
comment Does HTTPS protocol leak HTTP body length?
@JohnnyWong good question. On off note, can't help myself recommending the word 'attacker' here. To use 'hacker' for attacker is a sensationalist media invention. Stallman had this On hacking. Hacking is carried from a MIT recreational activity focused on wit and playfulness. Notably, [hackers] designed the Incompatible Timesharing System [where] there was no security breaking, because there was no security to break. For a hacker 'security' is an obstacle hindering playfulness. For an attacker/cracker, 'security' is part the target.
Aug
4
comment Why is using SSH key more secure than using passwords?
Like Reusing Private/Public Keys security.SE/10203, I see. Thanks for clearup!
Aug
4
comment What's the common pragmatic strategy for managing key pairs?
Related: Good practice to use same SSH keypair on multiple machines? unix.SE 27661
Aug
4
comment Why is using SSH key more secure than using passwords?
Related: Good practice to use same ssh keypair on multiple machnies unix.SE 27661
Aug
4
comment Why is using SSH key more secure than using passwords?
I was under the impression that keys and passes in ssh protect the server. The argument that using keys keeps the client's secret intact seems strange: if the server is already compromised then what's the value of keeping client keys/passes secret? (This still leaves the fake-server argument intact.) An attacker can already do whatever on the compromised server, including installing backdoors.
Dec
16
comment Can a neighbour who installed my router access it?
infeasible to pose as a neighbor for every not-so-interesting target just to build such infrastructure, agreed. it'd be relatively easier for such an attacker to get them infected in mass before they get to the distributors to be sold, which as we all may know it may be not just paranoia unfortunately. anyway I was just happy to see the broader context in your answer. interesting quote btw. a third way of course to social-engineer all neighbors to do so, but well, let's not get into that here.
Dec
16
comment Can a neighbour who installed my router access it?
depends on the attacker and its motives. for example, an attacker may want to deploy these tampered firmwares just to build an infrastructure for occasional mass-data-collection or mediator in creating zombie-machines, noone needs to be of particular interest personally, only as input source for a comparative analysis or whatever use.
Dec
16
comment Can a neighbour who installed my router access it?
Should I be concerned? how rational is it from the same information you gave us to suspect your neighbour to be malicious? everything is relative I suppose. you and the neighbour have a huge gap of IT capability so in theory the neighbour may would feel safe and confident that you wouldn't notice the difference if [s]he were attempt to trick you. would your neighbour need your data? for profit? for fun? you may want to make up some fake but beliveable information that makes her/him take a move. if the neighbour tries to use it for his/her advantage you can be sure about being monitored.
Dec
16
comment Can a neighbour who installed my router access it?
custom firmware with fake linksys logo and backdoors - the only answer so far that hints on these things.
Jul
7
comment Can robots.txt for your face be made effective?
@Damon additionally to the recognition, it is one thing to take a snapshot of the world's streets, and an entirely different thing to have continous, real-time omnipresent live broadcast of everything you can. If snapshots threaten privacy then you now have that per each frame per second, also indoors.
Jul
7
comment Can robots.txt for your face be made effective?
@Damon beside the good point, I see a problem with that. A public place like 'the street' was not expected to provide a way of systematic mass monitoring, when privacy protection traditions were introduced. So going 'public' on the street today is different than it was in Thomas Jefferson'‌​s time. The implicit privacy protections associated with 'public' relied on human-based abilities, not machine-based infrastructures.
Jul
3
comment What is the technical rationale behind intermediary email servers?
@schroeder good point but the intended security aspect is whether a system could be set up so no unexpected intermediary servers take place in the exchange. for that one should know the rationale. Aiming for a better question I added that.
Jun
26
comment Can robots.txt for your face be made effective?
http:// motherboard.vice.com / read / our-brains-will-be-hacked-tracked-and-data-mined
Feb
27
comment How to fight browser fingerprinting?
I think I should link the 2010 evercookie. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs), and others.
Dec
4
comment Couldn't websites that want to track our activity just store the data in the DOM?
aren't websites cached? that would give a slightly greater expiration to 'DOM-stored tracking information' than just memory.