665 reputation
210
bio website
location California
age
visits member for 2 years, 7 months
seen 10 hours ago

Jun
26
comment What's more secure? Hard coding credentials or storing them in a database?
You may think that an attacker wouldn't believe that the password is stored in code, but he's still going to look at the code to find the database table where the password hashes are stored, so he'll still find it. This is another case of security through obscurity -- don't count on the fact that you're "different" to help protect you, there's plenty of code out there with hard-coded passwords, so no attacker will be surprised to find it in your code.
Jun
20
comment Attacks on encrypted computer?
If you have enough privileged access to the hard drive that you can randomly flip bits, then couldn't you just flip all of the bits on the hard drive?
Jun
20
comment Trying to keep high school students out of the Wi-Fi network
This is the only real solution to the problem of students stealing the Wifi password -- if a teacher's password leaks, then lock out their account and have a talk with the teacher about securing their password.
Jun
6
comment Can a wifi provider decrypt HTTPS usind MITM without users noticing?
@SargeBorsch - the official download link may be HTTPS, but few users would notice if when they went to mozilla.org to find the download, the Wifi operator secretly rewrote that page to redirect the download link to point to their own infected copy of firefox... The official mozilla site may use HTTPS everywhere, but when I search Google for firefox download, the Go to download links points to the mozilla.org page, not the https page, leaving it open to interception.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
@atsby - If we pretended the disks didn't fail, we'd have lost the use of an entire tray of disks in our array since the disks did in fact fail. Since we used full disk encryption, we just sent them back after we swapped in the replacement disks, knowing that the encryption would prevent anyone from recovering data. Without encryption, we'd have had to physically destroy the disks and would have incurred the expensive non-returned disk fees.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
The maintenance contract on our storage array requires that failed disks be sent back to the company after swapping out (or we pay a hefty "non-return" fee on the drives). Without disk encryption, returning disks may not be possible since you can't wipe a failed disk. We had a power supply take out an entire disk tray once -- that would have cost us around $40,000 in non-returned disk fees.
May
9
comment New Gmail login system—going against conventional wisdom?
Lowering support volume is also (usually) more user friendly -- being hard enough to use that a significant number of users need to contact support is the opposite of good usability.
Mar
4
comment How does Android L achieve strong encryption with a low entropy passphrase?
It's worse than that - there are 389112 valid combinations -- some combinations are invalid because you can't skip over an adjacent dot (unless it's already been used. You can reduce the search space even farther by excluding "difficult" combinations that many people might not use.
Feb
16
comment How does a website know if a certain creditcard number is wrong instantly
How can they switch verification algorithms with millions of credit card terminals and software applications in the field that would need to be rewritten with the new algorithm?
Feb
7
comment Hashing a password, and summing it with every byte in a file. How secure?
"this is also only brute-forceable if you know what to expect" -- it's likely that you use some type of script or program to decrypt the file, so an attacker can look at that program to figure out how to reverse your encryption. but worse, if an attacker knows your password or some other plaintext in the file (like a username or web site name), he can use that knowledge to reduce the search space for his brute force attack.
Jan
17
comment Using Google Search results to determine password strength
I could see a google search being useful for phrase based passwords to rule out passwords like "correct horse battery staple", "the dark side of the moon", "rage against the machine", etc that people think are strong passwords because they are long, but they are actually quite common phrases. Google even seems to recognize common phrases without spaces like "ilovethesoundofmusic" and "icouldhavehadav8"
Jan
7
comment Firewall egress filtering / quick whitelisting
Local or Federal law enforcement may have the authority to target a local hacker, but except in high profile cases, they are unlikely to actually do so. Plus, it's likely that the "local" hack is actually controlled remotely from a foreign or obscured location so even if the police do end up finding the source of the attack, that doesn't mean that they'll find and stop the attacker.
Dec
24
comment What prevents web shop owners from misusing credit card data?
Note that the CVV and other sensitive data is allowed to be stored until after authorization, which could be hours, days, or even weeks after the purchase if the merchant batches up transactions and authorizes them after a period of time. Granted most merchants won't need to store the CVV, but it is allowed under some circumstances.
Dec
19
comment Best practices for usefully storing two factor authentication backup codes?
Before I printed out my Gmail backup codes, I rotated the codes by 2 digits to help obscure them (i.e. 123456 becomes 561234).... now I have to remember that they are rotated, but I seriously doubt that anyone that steals my wallet (and the codes) would know what they are even if I hadn't made that minimal level of obfuscation
Dec
7
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - That's why I said that it depends how badly the attacker wants whatever is being hid in the hashes. And it assumes that the attacker doesn't have a "free" resource like a Botnet or stolen compute cluster credentials that he could use. And over time, the cost to compute the hash table gets lower as computers become more powerful and less expensive.
Dec
3
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - depends how badly the attacker wants them. Since hash calculations are easily parallelized, he can compute the entire space in any arbitrary length of time (well, no less than one second) by using more compute resources. 1000 16 core servers can do it in in around 70 hours, and it would cost around $60K on Amazon if the attacker doesn't have a botnet that can do the work for him. If he knows something about who he's looking for (internet provider, country, etc), he may be able to greatly reduce the search space.
Nov
21
awarded  Yearling
Nov
13
comment should I not accept cookies for the sake of anonymity?
You need to do more than disable cookies to stay anonymous, many browsers leak a lot of uniquely identifying data. According to this site, my browser leaks around 22 bits of a identifying information and my browser is unique among the 4 million visitors to the site.
Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
The way that companies can prevent users from installing Virtual Box is to prevent them from installing Virtual Box - either by preventing all software installs, or using a whitelist of acceptable applications. Likewise, boot from USB can be disabled.
Apr
8
accepted Multiple user encryption-key store