645 reputation
210
bio website
location California
age
visits member for 2 years, 1 month
seen yesterday

2d
comment Best practices for usefully storing two factor authentication backup codes?
Before I printed out my Gmail backup codes, I rotated the codes by 2 digits to help obscure them (i.e. 123456 becomes 561234).... now I have to remember that they are rotated, but I seriously doubt that anyone that steals my wallet (and the codes) would know what they are even if I hadn't made that minimal level of obfuscation
Dec
7
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - That's why I said that it depends how badly the attacker wants whatever is being hid in the hashes. And it assumes that the attacker doesn't have a "free" resource like a Botnet or stolen compute cluster credentials that he could use. And over time, the cost to compute the hash table gets lower as computers become more powerful and less expensive.
Dec
3
comment Do I have to hash users' IP addresses when I log them?
@ponsfonze - depends how badly the attacker wants them. Since hash calculations are easily parallelized, he can compute the entire space in any arbitrary length of time (well, no less than one second) by using more compute resources. 1000 16 core servers can do it in in around 70 hours, and it would cost around $60K on Amazon if the attacker doesn't have a botnet that can do the work for him. If he knows something about who he's looking for (internet provider, country, etc), he may be able to greatly reduce the search space.
Nov
21
awarded  Yearling
Nov
13
comment should I not accept cookies for the sake of anonymity?
Enabling cookies will help with anonymity since a cookie can provide a guaranteed unique identifier, but enabling cookies alone is not sufficient to ensure anonymity. There are guides that will help show you how to stay anonymous, and there's a tor browser that can also help.
Nov
13
comment should I not accept cookies for the sake of anonymity?
You need to do more than disable cookies to stay anonymous, many browsers leak a lot of uniquely identifying data. According to this site, my browser leaks around 22 bits of a identifying information and my browser is unique among the 4 million visitors to the site.
Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
The way that companies can prevent users from installing Virtual Box is to prevent them from installing Virtual Box - either by preventing all software installs, or using a whitelist of acceptable applications. Likewise, boot from USB can be disabled.
Apr
8
accepted Multiple user encryption-key store
Apr
8
comment Multiple user encryption-key store
I figured there'd be dozens of algorithms and options, but based on the lack of responses, it seems like this is the about the only choice.
Apr
4
comment Any way to obfuscate *when* two end hosts are communicating?
How about just sending dummy data at random times that's similar to the "real" data you're trying to hide - if it's encrypted, its going to be hard for an attacker to know which is real and which is fake as long as the receiving host returns similar dummy data as it would for a real transfer.
Apr
3
comment What can be done to prevent disruption of hardware in the event of a powerful solar flare?
This seems to be off-topic for security.stackexchange.com. Not sure where it might be more appropriate... perhaps electronics.stackexchange.com since it's primarily a question about hardware protection rather than being about and particular system type?
Apr
3
asked Multiple user encryption-key store
Apr
3
comment Watching for applications like WireShark and other eaves dropping on corporate network
Most corporate networks will use some sort of NAC to ensure that only "approved" devices that meet security policies (patch level, antivirus, etc) can get on the network.
Apr
2
comment Threats against website running without TLS but with PGP messages
How does the client validate the server's PGP key? Without a trusted authority, a man in the middle could sit between the client and server and substitute his own PGP keys for yours to intercept traffic.
Apr
1
comment What is the preferred way of using AWS (specifically S3) from mobile apps?
The article you linked to linked to this article at Amazon: Using temporary security credentials, so that appears to be Amazon's recommended solution. I don't think there's an answer to "How do I give the user an app that has permission to do something without giving a malicious user that controls the app permission to do that same thing". I'd look at restricting the access to resources that the app has to limit the damage that a malicious user could do.
Mar
28
comment can you update a one-time pad, over one-time pad encryption (compressed)?
@pacifist - There is no question about whether or not you can compress random data. Compression works by looking for patterns and redundancies in the data and optimizing them out, and by definition, random data has no patterns or redundancies except what might occur by chance. A dictionary large enough to compress random data would be as large as the random data itself. Well compressed data looks a lot like random data (but it's not), so if it were possible to compress random data, you could keep compressing a compressed file over and over again until it was down to a single byte (or bit).
Mar
28
comment can you update a one-time pad, over one-time pad encryption (compressed)?
Since the OTP is supposed to be crytographically secure random data, it should not be compressible at all.
Mar
27
comment Are there any systems out there that use a one-time pad?
Then you should take out the whole section about the network, since there are a lot more ways to corrupt a message than sending it across a network (which already computes a checksum of the data, usually at multiple levels in the stack). There's no reason to add a hash of the plaintext outside of the encrypted payload, since as you say, it leaks data about the plaintext. The plaintext hash can be included within the encrypted payload, or a hash of the encrypted data can be added to allow validation of the encrypted data.
Mar
27
comment Are there any systems out there that use a one-time pad?
The network doesn't hash or checksum the original plaintext message - under normal circumstances, the network never sees or knows about the plaintext (all it sees is data, it has no idea if it's encrypted data). If hashing of the plaintext is desirable to ensure integrity of the decrypted message, that can be done by the encryption software (and included as a part of the encrypted payload so no attacker can see it).
Mar
27
comment SSL is Extended Validation more secure?
I believe there are only two types of validation visible to the user -- basic and extended. Business validation may mean you can put a validation seal on your website, but anyone can fraudulently put up that seal or make up one of their own. Only EV certs give the user a hard to spoof visible confirmation that the site is using an EV cert. "Business validation" seems like it's not worth paying for. Unless you're accepting payment or sensitive personal information, I wouldn't even bother with an EV cert - it doesn't make your site more secure, but gives your users peace of mind.