665 reputation
210
bio website
location California
age
visits member for 2 years, 6 months
seen 5 hours ago

2d
comment Is full disk encryption on a server in a secure data center pointless?
@atsby - If we pretended the disks didn't fail, we'd have lost the use of an entire tray of disks in our array since the disks did in fact fail. Since we used full disk encryption, we just sent them back after we swapped in the replacement disks, knowing that the encryption would prevent anyone from recovering data. Without encryption, we'd have had to physically destroy the disks and would have incurred the expensive non-returned disk fees.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
The maintenance contract on our storage array requires that failed disks be sent back to the company after swapping out (or we pay a hefty "non-return" fee on the drives). Without disk encryption, returning disks may not be possible since you can't wipe a failed disk. We had a power supply take out an entire disk tray once -- that would have cost us around $40,000 in non-returned disk fees.
May
9
comment New Gmail login system—going against conventional wisdom?
Lowering support volume is also (usually) more user friendly -- being hard enough to use that a significant number of users need to contact support is the opposite of good usability.
Mar
4
comment How does Android L achieve strong encryption with a low entropy passphrase?
It's worse than that - there are 389112 valid combinations -- some combinations are invalid because you can't skip over an adjacent dot (unless it's already been used. You can reduce the search space even farther by excluding "difficult" combinations that many people might not use.
Feb
16
comment How does a website know if a certain creditcard number is wrong instantly
How can they switch verification algorithms with millions of credit card terminals and software applications in the field that would need to be rewritten with the new algorithm?
Feb
7
comment Hashing a password, and summing it with every byte in a file. How secure?
"this is also only brute-forceable if you know what to expect" -- it's likely that you use some type of script or program to decrypt the file, so an attacker can look at that program to figure out how to reverse your encryption. but worse, if an attacker knows your password or some other plaintext in the file (like a username or web site name), he can use that knowledge to reduce the search space for his brute force attack.
Jan
17
comment Using Google Search results to determine password strength
I could see a google search being useful for phrase based passwords to rule out passwords like "correct horse battery staple", "the dark side of the moon", "rage against the machine", etc that people think are strong passwords because they are long, but they are actually quite common phrases. Google even seems to recognize common phrases without spaces like "ilovethesoundofmusic" and "icouldhavehadav8"
Jan
7
comment Firewall egress filtering / quick whitelisting
Local or Federal law enforcement may have the authority to target a local hacker, but except in high profile cases, they are unlikely to actually do so. Plus, it's likely that the "local" hack is actually controlled remotely from a foreign or obscured location so even if the police do end up finding the source of the attack, that doesn't mean that they'll find and stop the attacker.
Dec
24
comment What prevents web shop owners from misusing credit card data?
Note that the CVV and other sensitive data is allowed to be stored until after authorization, which could be hours, days, or even weeks after the purchase if the merchant batches up transactions and authorizes them after a period of time. Granted most merchants won't need to store the CVV, but it is allowed under some circumstances.
Dec
19
comment Best practices for usefully storing two factor authentication backup codes?
Before I printed out my Gmail backup codes, I rotated the codes by 2 digits to help obscure them (i.e. 123456 becomes 561234).... now I have to remember that they are rotated, but I seriously doubt that anyone that steals my wallet (and the codes) would know what they are even if I hadn't made that minimal level of obfuscation
Dec
7
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - That's why I said that it depends how badly the attacker wants whatever is being hid in the hashes. And it assumes that the attacker doesn't have a "free" resource like a Botnet or stolen compute cluster credentials that he could use. And over time, the cost to compute the hash table gets lower as computers become more powerful and less expensive.
Dec
3
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - depends how badly the attacker wants them. Since hash calculations are easily parallelized, he can compute the entire space in any arbitrary length of time (well, no less than one second) by using more compute resources. 1000 16 core servers can do it in in around 70 hours, and it would cost around $60K on Amazon if the attacker doesn't have a botnet that can do the work for him. If he knows something about who he's looking for (internet provider, country, etc), he may be able to greatly reduce the search space.
Nov
21
awarded  Yearling
Nov
13
comment should I not accept cookies for the sake of anonymity?
You need to do more than disable cookies to stay anonymous, many browsers leak a lot of uniquely identifying data. According to this site, my browser leaks around 22 bits of a identifying information and my browser is unique among the 4 million visitors to the site.
Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
The way that companies can prevent users from installing Virtual Box is to prevent them from installing Virtual Box - either by preventing all software installs, or using a whitelist of acceptable applications. Likewise, boot from USB can be disabled.
Apr
8
accepted Multiple user encryption-key store
Apr
8
comment Multiple user encryption-key store
I figured there'd be dozens of algorithms and options, but based on the lack of responses, it seems like this is the about the only choice.
Apr
4
comment Any way to obfuscate *when* two end hosts are communicating?
How about just sending dummy data at random times that's similar to the "real" data you're trying to hide - if it's encrypted, its going to be hard for an attacker to know which is real and which is fake as long as the receiving host returns similar dummy data as it would for a real transfer.
Apr
3
comment What can be done to prevent disruption of hardware in the event of a powerful solar flare?
This seems to be off-topic for security.stackexchange.com. Not sure where it might be more appropriate... perhaps electronics.stackexchange.com since it's primarily a question about hardware protection rather than being about and particular system type?
Apr
3
asked Multiple user encryption-key store