646 reputation
110
bio website
location California
age
visits member for 1 year, 11 months
seen 2 days ago

Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
The way that companies can prevent users from installing Virtual Box is to prevent them from installing Virtual Box - either by preventing all software installs, or using a whitelist of acceptable applications. Likewise, boot from USB can be disabled.
Apr
8
accepted Multiple user encryption-key store
Apr
8
comment Multiple user encryption-key store
I figured there'd be dozens of algorithms and options, but based on the lack of responses, it seems like this is the about the only choice.
Apr
4
comment Any way to obfuscate *when* two end hosts are communicating?
How about just sending dummy data at random times that's similar to the "real" data you're trying to hide - if it's encrypted, its going to be hard for an attacker to know which is real and which is fake as long as the receiving host returns similar dummy data as it would for a real transfer.
Apr
3
comment What can be done to prevent disruption of hardware in the event of a powerful solar flare?
This seems to be off-topic for security.stackexchange.com. Not sure where it might be more appropriate... perhaps electronics.stackexchange.com since it's primarily a question about hardware protection rather than being about and particular system type?
Apr
3
asked Multiple user encryption-key store
Apr
3
comment Watching for applications like WireShark and other eaves dropping on corporate network
Most corporate networks will use some sort of NAC to ensure that only "approved" devices that meet security policies (patch level, antivirus, etc) can get on the network.
Apr
2
comment Threats against website running without TLS but with PGP messages
How does the client validate the server's PGP key? Without a trusted authority, a man in the middle could sit between the client and server and substitute his own PGP keys for yours to intercept traffic.
Apr
1
comment What is the preferred way of using AWS (specifically S3) from mobile apps?
The article you linked to linked to this article at Amazon: Using temporary security credentials, so that appears to be Amazon's recommended solution. I don't think there's an answer to "How do I give the user an app that has permission to do something without giving a malicious user that controls the app permission to do that same thing". I'd look at restricting the access to resources that the app has to limit the damage that a malicious user could do.
Mar
28
comment can you update a one-time pad, over one-time pad encryption (compressed)?
@pacifist - There is no question about whether or not you can compress random data. Compression works by looking for patterns and redundancies in the data and optimizing them out, and by definition, random data has no patterns or redundancies except what might occur by chance. A dictionary large enough to compress random data would be as large as the random data itself. Well compressed data looks a lot like random data (but it's not), so if it were possible to compress random data, you could keep compressing a compressed file over and over again until it was down to a single byte (or bit).
Mar
28
comment can you update a one-time pad, over one-time pad encryption (compressed)?
Since the OTP is supposed to be crytographically secure random data, it should not be compressible at all.
Mar
27
comment Are there any systems out there that use a one-time pad?
Then you should take out the whole section about the network, since there are a lot more ways to corrupt a message than sending it across a network (which already computes a checksum of the data, usually at multiple levels in the stack). There's no reason to add a hash of the plaintext outside of the encrypted payload, since as you say, it leaks data about the plaintext. The plaintext hash can be included within the encrypted payload, or a hash of the encrypted data can be added to allow validation of the encrypted data.
Mar
27
comment Are there any systems out there that use a one-time pad?
The network doesn't hash or checksum the original plaintext message - under normal circumstances, the network never sees or knows about the plaintext (all it sees is data, it has no idea if it's encrypted data). If hashing of the plaintext is desirable to ensure integrity of the decrypted message, that can be done by the encryption software (and included as a part of the encrypted payload so no attacker can see it).
Mar
27
comment SSL is Extended Validation more secure?
I believe there are only two types of validation visible to the user -- basic and extended. Business validation may mean you can put a validation seal on your website, but anyone can fraudulently put up that seal or make up one of their own. Only EV certs give the user a hard to spoof visible confirmation that the site is using an EV cert. "Business validation" seems like it's not worth paying for. Unless you're accepting payment or sensitive personal information, I wouldn't even bother with an EV cert - it doesn't make your site more secure, but gives your users peace of mind.
Mar
27
comment Is it a real security benefit if a host uses static IP Addresses for authentication?
I don't think dyndns or noip will give you a static IP -- what they do is give you a known static DNS hostname that updates itself to point to whatever dynamic IP your home server happens to have. So it's a static hostname, but that's different from a static IP. There are some VPN providers that can offer you a static IP, but that's really what your company should be doing -- set up a VPN server with two factor authentication to give you access to their servers. A static IP provides only a small amount of additional security, they should be able to trust in their VPN server's security.
Mar
26
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
@mikebabcock - SSL might not hide anything at all from your employer as they can use a decrypting proxy to intercept all of your SSL traffic, or client side monitoring that hooks into your web browser.
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
There are some authentication protocols (like CHAP) that require the plaintext password. The hosting service may be supporting an authentication protocol that requires access to the plaintext password. Even though they said that it's plaintext, it could still be encrypted but with the ability to decrypt back to plaintext. Still not great from a security standpoint, but not as bad as plaintext and sometimes is a necessary evil.
Feb
6
comment Should I reject obviously poor passwords?
You can't write a secure password validator that validates passwords by calling an external (and untrusted) search engine. Otherwise, every password you test immediately becomes unsafe because you just handed it to someone else.
Feb
3
comment Is it PCI compliant to send credit card details to the server without saving them there?
If he's writing his own mobile app that accepts credit card data and sends it to a server for processing (whether his server or someone else's), I don't see how it could escape being defined as a "Payment Application (Any application that stores, processes, or transmits cardholder data as part of authorization or settlement)" under PCI. Since he's writing the app, he has to follow PCI compliance guidelines to protect sensitive cardholder data.
Feb
3
comment Is it PCI compliant to send credit card details to the server without saving them there?
@AJHenderson I think the iOS app itself would still fall under PCI compliance requirements if it's accepting credit card data and transmitting it to the payment vendor to receive a token. I'm not sure if this is what you were suggesting, or if you were suggesting handing off the entire transaction (including accepting the user's credit card) to a payment vendor's application.