655 reputation
210
bio website
location California
age
visits member for 2 years, 4 months
seen Mar 25 at 18:48

Mar
23
comment How can I tell if someone is intercepting my cell phone signal using mobile signal tracking software?
Towers used for cell service are often rented to many different radio services, so just the fact that you see odd looking antennas on the tower, doesn't mean that someone is up to anything nefarious. In fact, the nefarious actor is likely to take great pains to hide his equipment, so you'd never see it from a casual inspection.
Mar
4
comment How does Android L achieve strong encryption with a low entropy passphrase?
It's worse than that - there are 389112 valid combinations -- some combinations are invalid because you can't skip over an adjacent dot (unless it's already been used. You can reduce the search space even farther by excluding "difficult" combinations that many people might not use.
Feb
16
comment How does a website know if a certain creditcard number is wrong instantly
How can they switch verification algorithms with millions of credit card terminals and software applications in the field that would need to be rewritten with the new algorithm?
Feb
7
comment Hashing a password, and summing it with every byte in a file. How secure?
"this is also only brute-forceable if you know what to expect" -- it's likely that you use some type of script or program to decrypt the file, so an attacker can look at that program to figure out how to reverse your encryption. but worse, if an attacker knows your password or some other plaintext in the file (like a username or web site name), he can use that knowledge to reduce the search space for his brute force attack.
Jan
17
comment Using Google Search results to determine password strength
I could see a google search being useful for phrase based passwords to rule out passwords like "correct horse battery staple", "the dark side of the moon", "rage against the machine", etc that people think are strong passwords because they are long, but they are actually quite common phrases. Google even seems to recognize common phrases without spaces like "ilovethesoundofmusic" and "icouldhavehadav8"
Jan
7
comment Firewall egress filtering / quick whitelisting
Local or Federal law enforcement may have the authority to target a local hacker, but except in high profile cases, they are unlikely to actually do so. Plus, it's likely that the "local" hack is actually controlled remotely from a foreign or obscured location so even if the police do end up finding the source of the attack, that doesn't mean that they'll find and stop the attacker.
Dec
24
comment What prevents web shop owners from misusing credit card data?
Note that the CVV and other sensitive data is allowed to be stored until after authorization, which could be hours, days, or even weeks after the purchase if the merchant batches up transactions and authorizes them after a period of time. Granted most merchants won't need to store the CVV, but it is allowed under some circumstances.
Dec
19
comment Best practices for usefully storing two factor authentication backup codes?
Before I printed out my Gmail backup codes, I rotated the codes by 2 digits to help obscure them (i.e. 123456 becomes 561234).... now I have to remember that they are rotated, but I seriously doubt that anyone that steals my wallet (and the codes) would know what they are even if I hadn't made that minimal level of obfuscation
Dec
7
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - That's why I said that it depends how badly the attacker wants whatever is being hid in the hashes. And it assumes that the attacker doesn't have a "free" resource like a Botnet or stolen compute cluster credentials that he could use. And over time, the cost to compute the hash table gets lower as computers become more powerful and less expensive.
Dec
3
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - depends how badly the attacker wants them. Since hash calculations are easily parallelized, he can compute the entire space in any arbitrary length of time (well, no less than one second) by using more compute resources. 1000 16 core servers can do it in in around 70 hours, and it would cost around $60K on Amazon if the attacker doesn't have a botnet that can do the work for him. If he knows something about who he's looking for (internet provider, country, etc), he may be able to greatly reduce the search space.
Nov
21
awarded  Yearling
Nov
13
comment should I not accept cookies for the sake of anonymity?
You need to do more than disable cookies to stay anonymous, many browsers leak a lot of uniquely identifying data. According to this site, my browser leaks around 22 bits of a identifying information and my browser is unique among the 4 million visitors to the site.
Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
The way that companies can prevent users from installing Virtual Box is to prevent them from installing Virtual Box - either by preventing all software installs, or using a whitelist of acceptable applications. Likewise, boot from USB can be disabled.
Apr
8
accepted Multiple user encryption-key store
Apr
8
comment Multiple user encryption-key store
I figured there'd be dozens of algorithms and options, but based on the lack of responses, it seems like this is the about the only choice.
Apr
4
comment Any way to obfuscate *when* two end hosts are communicating?
How about just sending dummy data at random times that's similar to the "real" data you're trying to hide - if it's encrypted, its going to be hard for an attacker to know which is real and which is fake as long as the receiving host returns similar dummy data as it would for a real transfer.
Apr
3
comment What can be done to prevent disruption of hardware in the event of a powerful solar flare?
This seems to be off-topic for security.stackexchange.com. Not sure where it might be more appropriate... perhaps electronics.stackexchange.com since it's primarily a question about hardware protection rather than being about and particular system type?
Apr
3
asked Multiple user encryption-key store
Apr
3
comment Watching for applications like WireShark and other eaves dropping on corporate network
Most corporate networks will use some sort of NAC to ensure that only "approved" devices that meet security policies (patch level, antivirus, etc) can get on the network.
Apr
2
comment Threats against website running without TLS but with PGP messages
How does the client validate the server's PGP key? Without a trusted authority, a man in the middle could sit between the client and server and substitute his own PGP keys for yours to intercept traffic.