Reputation
890
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 11
Newest
 Enlightened
Impact
~54k people reached

  • 0 posts edited
  • 4 helpful flags
  • 28 votes cast
Aug
25
comment Why do we still use keys to start cars? why not passwords?
@LorenPechtel - I'm sure the rental car agencies would love car passwords, all they have to do is print out the password (resetting it for each customer) and hand it to the customer -- no keys to deal with, and no need to handle customer lockouts.
Aug
11
comment Preventing Ethernet over power
@bkief - I've confirmed that they are opposite legs, the breakers that control the outlets are on opposite buses on the breaker panel. I'm skeptical that the signal is really traveling all the way outside through the service entrance up to and through transformer on the pole and back down the other leg, it's more likely that the lines are coupled since they run next to each other past the service panel which means that even a perfect isolation transformer won't help if the wires from different phases run next to each other.
Aug
11
comment Preventing Ethernet over power
If he's that worried about someone tapping into his network, he should be authenticating ports on his switches.
Aug
11
comment Preventing Ethernet over power
Don't count on a isolation transformer to block RF over powerlines -- I'm running a home powerline network across two legs of my 240V service feed and it works reasonably well -- I get around 25mbit (using adapters rated for 100mbit). I don't know if the signal is going through my service feed and through the power company's transformer, or through inductive coupling of wires in my walls, but it works.
Aug
11
comment How does the attacker to ransomware get the password?
@Aron - or trace back to one of the attacker's disposable bots, of which he has many.
Jul
31
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
You can't just "encrypt" a string using SSL and pass it to any webserver's SSL port at-is. SSL is a protocol that involves active handshaking between the sender and receiver, so you have to use an SSL client to talk to an SSL server.
Jul
30
comment How secure is VOIP?
And if he is being specifically targeted, it's probably easier for a thief to tap into an analog phone line either through the demarc box on the back of his house or the telco junction box out on the street than to tap his VoIP calls. Back when long distance was expensive, I had someone tap into my demarc box to make international calls during the day when I was at work - nearly $1000 worth of calls in a month. The Telco replaced it with a locked box and that took care of the problem (they probably just moved to the neighbor's house)
Jul
22
comment Fake UserAgent visitor attack?
@DmitryGrigoryev - agreed - while it's possible to combine dictionary words to make a strong password, it's hard to get users to understand that they have to be randomly selected, not common phrases. Even after showing them the xkcd comic often people will say "Oh you mean like 'darksideofthemoon' or 'closebutnocigar'?"
Jul
20
comment Should I implement incorrect password delay in a website or a webservice?
I don't think that have an artificial pause for failed login attempts makes the server more susceptible to DoS attacks than if it returned immediately - a server is likely no worse of having 1000 threads sleeping for 10 seconds before returning a bad password error is probably no worse than 1000 (or even 100) CPU bound threads actively calculating a password hash and consuming all of the CPU on the server.
Jul
16
comment Could anyone technically see my requests with TOR if the person has access to my router?
While your answer is factually correct, it doesn't really answer the question unless the asker happens to know the difference between an entry node and an exit node (and many, perhaps most, Tor users do not).
Jul
10
awarded  Enlightened
Jul
10
awarded  Nice Answer
Jul
9
revised Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
Add section about email forwarding
Jul
9
comment Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
@SilverlightFox - Good point - thanks! I forgot about email forwarding, I'll add that to my answer for completeness.
Jul
9
answered Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
Jul
9
comment Secure communication in SHTF
I'll add that if you plan to use ham radio to communicate, you're not legally allowed to use encryption on the ham bands. Maybe you don't care in a SHTF scenario, but if one of your of your scenarios means resisting government corruption/takeover, you probably don't want to so visibly violate the law, which gives the government an excuse to come visit your compound.
Jul
8
comment Secure communication in SHTF
How secure do you need to be? You could use a Book Cipher that uses pages of a book as the OTP, and use some algorithm that can be memorized (like 2 times the date minus the month) to select the page of the book to use as today's OTP so even if someone knows which book you're using, they can't instantly decrypt tomorrow's message. This is not very secure if your adversary has a computer (and even if he doesn't), but it gives you reasonable privacy against a casual listener.
Jun
26
comment What's more secure? Hard coding credentials or storing them in a database?
You may think that an attacker wouldn't believe that the password is stored in code, but he's still going to look at the code to find the database table where the password hashes are stored, so he'll still find it. This is another case of security through obscurity -- don't count on the fact that you're "different" to help protect you, there's plenty of code out there with hard-coded passwords, so no attacker will be surprised to find it in your code.
Jun
20
comment Attacks on encrypted computer?
If you have enough privileged access to the hard drive that you can randomly flip bits, then couldn't you just flip all of the bits on the hard drive?
Jun
20
comment Trying to keep high school students out of the Wi-Fi network
This is the only real solution to the problem of students stealing the Wifi password -- if a teacher's password leaks, then lock out their account and have a talk with the teacher about securing their password.