Reputation
945
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 13
Newest
 Quorum
Impact
~73k people reached

Mar
22
comment Can the NSA/FBI Recover Encrypted iPhone Contents by Decapping the Chips?
I'm curious about this too -- I've seen a lot of people say "All the FBI has to do is decap the chip and read the flash with an electron microscope", but how feasible is that without damaging the chip and destroying the key? Why kind of success rate would a procedure like this have? How commonly is it done?
Mar
22
comment Can I use my old SSL certificate with websites in subfolders?
@immibis: Yes, I understand that, you understand that, but the author of the question apparently does not. And since he doesn't know enough about the web or how SSL certs work to make that distinction, I don't see how he's going to know the answer to HankyPanky's restating of the question. Based on his comments on the accepted answer, he thinks that the SSL cert is tied to folders on his website. Which is a reasonable misconception for someone with only a cursory understanding of what an SSL cert does, so he has a valid question.
Mar
21
comment Can I use my old SSL certificate with websites in subfolders?
@HankyPanky - I think you're just restating his question, if he knew the answer to that question he wouldn't be asking here.
Mar
17
comment What's the point of the CA?
How do you know that the box of flash drives out the counter that say "Here's our public key, take one!" is really from the business and that someone didn't just dump some of their own keys in there? Likewise, even if the guy behind the counter gives it to you, how do you know that what he gave you is the real key and that he wasn't paid to hand out fake ones?
Feb
22
comment Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
@WilliamTFroggard - got any references for that success rate? I've seen lots of theories online about decapping IC"s and using an electron microscope to read the flash, but few details or statistics about success rates. If it were a cost effective and reliable way to hack encryption (especially when reading from a security chip where the designer wanted to intentionally hide the data), wouldn't the FBI already be doing so?
Feb
20
comment Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
@ThomasPornin - Sure they could buy a dozen (or 100) phones to play with, but if they are unsuccessful on 2 out of 12, are they going to accept a 1 in 6 chance that they'll destroy the evidence? The skills and equipment to do so are not cheap, so they could rack up hundreds of thousands of dollars (or millions?) just in testing the technique.
Feb
12
awarded  Quorum
Feb
4
awarded  Pundit
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
I would question why the school is designing their own door authentication system when there are already a wide variety of commercial products out there that do the same thing (that the school is probably already using to secure its doors). If you have something too secret for just a card-access or a PIN pad to protect, add a biometrics device to the "secure" room and tightly control who is enrolled to use that device.
Feb
2
comment Why is leaving a passworded SSH over the internet so bad?
Another relevant post: Did I just get hacked. Even if you're sure that you would never use an insecure password, you're still at risk if a package owner does something stupid like creates a service user with a weak password (or no password at all).
Jan
31
comment How secure can you be on an untrusted machine?
How do you define a "session"? If a session is defined by a session cookie (and maybe tied to the same IP address it was issued to), the attacker can copy that cookie into his own browser session and have the same logged in privileges as you. You'd be safer if retrieving each secure page meant re-authenticating again, but even then, the attacker can view every page you do.
Jan
31
comment Securely storing an encryption key on AWS
AWS does not use off the shelf Dell hardware, and they securely delete data from decommissioned disks: AWS uses the techniques detailed in DoD 5220.22-M (“National Industrial Security Program Operating Manual “) or NIST 800-88 (“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process
Jan
31
comment Securely storing an encryption key on AWS
@codin AWS can be part of a HIPAA compliant environment to run applications covered under HIPAA guidelines, so apparently they have the policies and procedures in place to be trusted to process private data. (assuming that your own policies and procedures are in place). They have additional security certifications as well.
Jan
30
comment Are partially typed passwords a potential security risk?
An 8 character password is already not very secure and if someone managed to steal your password hash, it wouldn't take long to brute force it.
Jan
23
comment How do I store a swipe pattern in a password manager?
@Jakuje - he's not suggesting using the shape of the letter to remember the pattern, but to number the dots 1 - 9 and use the those numbers to describe the pattern. He just mentioned the "Z" because that's the shape of his sample pattern. Using the numbers, a "diagonal pattern Z" would be 7895123. The only ambiguity is remembering how the dots are numbered (i.e. with 123 at the top like a phone keypad or at the bottom like a computer or calculator keypad). The answer would probably be more clear if the diagram included the numbers for each position.
Jan
12
comment Overwriting only Free Space with rubbish data to prevent data recovery?
I don't think the cipher command wipes just free space that was allocated for that specific folder, it wipes all free space on the entire drive that folder is on. From the MS support site: Type cipher /w:'folder', and then press ENTER, where folder is optional and can be any folder in a local volume that you want to clean. For example, the cipher /w:c:\test command causes the deallocated space on drive C: to be overwritten. If c:\test is a mount point or points to a folder in another volume, deallocated space on that volume will be cleaned.
Jan
12
comment Secure data by encrypting and rewriting on same file
I think you have it backwards - thanks to wear leveling, even if you rewrite the "same" blocks on an SSD, the controller may write the data someplace completely different, leaving the old data intact (which may or may not be recoverable using low level tools). Even a magnetic hard drive might remap sectors leaving your unencrypted data subject to recovery, even if you overwrite all free space. The best way to prevent data from being recovered is to not write it in plain text in the first place.
Jan
9
comment What prevents criminals from buying a new PC and going on public wifi?
If he's tracked back to that public Wifi network, security cameras may have captured him. Or his MAC address may be traceable by the manufacturer to identify him. (so he should spoof his MAC and not be in plain sight when using that public Wifi, perhaps using a high gain antenna to let him stay far away from the access point)
Jan
7
comment TLS Bicycle Attack - What cipher is free from flaws to use?
@SEJPM - Why can't crypto hide the message length either deliberately or as a side effect? Encfs can round up filenames to the block size of the encryption cipher. So, for example, with a blocksize of 16, an attacker can't tell the difference between a single character filename and a 16 character filename (which might otherwise leak enough information for an attacker to find the file he's seeking)
Jan
7
awarded  Popular Question