Johnny

426 reputation

bio	website
	location
	age
visits	member for	5 months
	seen	4 hours ago
stats	profile views	4

	426 reputation	bio	website		visits	member for	5 months
5 badges		location			seen	4 hours ago

summary answers questions tags badges favorites bounties reputation activity

48 Actions

suggestions reviews revisions comments badges posts accepts all

13h	comment	Do SSD's offer significant performance boost for Scrypt? SSD's show the biggest boost over hard drives in random I/O, but they are typically faster than spinning hard drives even in sequential I/O. The Samsung 840 SSD is rated at 530MB sustained sequential read performance, while a Seagate Cheetah 15K RPM SAS drive is rated at [122-204 MB/sec ](seagate.com/files/docs/pdf/datasheet/disc/…) (depending on if you're reading from the inside edge of the disk or outside)
13h	comment	Detecting skimmers and other ATM traps I've stopped using my ATM card anywhere but my bank's ATM machines (inside the bank when possible) after a local supermarket chain had skimmers in their in-store POS terminals
May 13	comment	Computing entropy for a passphrase ( minimal word length … ) Isn't "real" entropy (as opposed to psuedo random made up entropy) similar to gasoline in that you can only "pump" a finite amount of it out of your system until you need to go searching for more, which can take some time?
May 10	comment	Can you tell if your computer was hacked and pictures stolen from 2-6 months ago? If the ex-husband really got the pics from your 'friend', it's probably more likely that the 'friend' either copied them from your computer or one of the other two 'trusted' holders of the pictures. There's lots of ways to set up auditing beforehand proactively log any access to the files in question, but nearly impossible to track it down 2 months later.
May 9	comment	Intel How Strong is Your Password page, good advice? Do hackers really look at cracked passwords and try them manually at other sites? I assumed when they stole hashes and cracked a few thousand passwords, they had a script automatically test those passwords on a few hundred high value sites (online banking, etc) to come up with a short list of targets. Do they really publish the list of hacked passwords or look at the passwords for patterns?
May 8	revised	PCI DSS and Memcached added 12 characters in body
May 8	revised	PCI DSS and Memcached added 137 characters in body
May 8	answered	PCI DSS and Memcached
May 7	comment	How to encrypt data on the server? An Intel Core i3 550 3.2Ghz CPU can handle AES256 at 392 MB/s, which is probably faster than your disks can read/write data so you likely don't have to worry too much about performance unless your CPU's are busy doing other things while reading/writing data from disk. An Intel Core i5 661 with hardware AES acceleration can do AES256 at over 4GB/second.
May 7	comment	Alternative to VPN How about if instead of a VPN and/or portknocking, the remote router accepts no incoming internet connections at all, but when it's woken up by a phone call, it opens an SSH connection to a server at the main office (validating the host key to prevent MitM attacks) and opens a tunnel back to its own SSH server listening only to the localhost address?
May 7	revised	IPSec, hubs, crypto maps added 34 characters in body
May 7	comment	Do honeywords add any real security? I'd think you could use a honeyword from common hacking wordlists to be sure that the hacker will find it before they find the user's real password. Since there are millions of words in a password wordlist and you pick only a few of them for the user's honeywords, there's a slim chance that the user will stumble across the same words you picked, and if they do, worst case is you lock his account and he has to unlock it. And you should probably prevent a user from using a password from a hacker wordlist in the first place.
May 7	answered	IPSec, hubs, crypto maps
May 6	comment	Does prompting for security questions on new computers add any security on banking websites? If they have your password, but not your security questions, then they haven't won since they need the answers to your security questions too. If banks used onscreen PIN pads, then keygrabbers would just need to grab an image of the screen (or maybe just the area of the screen near mouse clicks). Two factor authentication would be better - like an auth code SMS'ed to your phone, or a code provided by an authentication token.
May 2	comment	Why would a website allow answers to security questions to be used interchangeably? Why couldn't "John" be a valid answer to "Where do you live"? Even if there's no city named "John", there may be a neighborhood, or other locality named "John". And of course, the most secure answer to that question wouldn't be a place name at all, it would be some completely unrelated answer. My answer to "what is your mother's maiden name" is not my mother's maiden name, nor even a name at all.
May 2	comment	Could a password hash that's prone to more collisions provide better overall security? Right, but if the attacker doesn't have the hashes for the second site, then he has to test them one by one through the site's normal login form, giving site B the ability to lock out the account after X wrong password attempts, possibly alerting the user and forcing him to set a new password to unlock his account.
May 2	awarded	Student
May 2	comment	Is there a way to get Tor “for free”? (free as in time, not money) If you're looking for a moderate amount of privacy with ease of use, you might be better off with a web proxy or VPN (there are paid and free versions). It's likely to be faster than Tor, but not nearly as effective at hiding your browser activity. proxysp.com/web-proxies
May 2	asked	Could a password hash that's prone to more collisions provide better overall security?
May 2	comment	Decrypt my cookie That sessionID probably contains no information itself, it's just a pointer to session data on the server, so there's no way to "decode" it because there's nothing encoded, it's just a pointer into a session table.