Reputation
916
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 13
Newest
 Quorum
Impact
~67k people reached

22h
awarded  Quorum
Feb
5
suggested rejected edit on detect forged e-mail system for windows?
Feb
4
awarded  Pundit
Feb
3
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
I would question why the school is designing their own door authentication system when there are already a wide variety of commercial products out there that do the same thing (that the school is probably already using to secure its doors). If you have something too secret for just a card-access or a PIN pad to protect, add a biometrics device to the "secure" room and tightly control who is enrolled to use that device.
Feb
2
comment Why is leaving a passworded SSH over the internet so bad?
Another relevant post: Did I just get hacked. Even if you're sure that you would never use an insecure password, you're still at risk if a package owner does something stupid like creates a service user with a weak password (or no password at all).
Jan
31
comment How secure can you be on an untrusted machine?
How do you define a "session"? If a session is defined by a session cookie (and maybe tied to the same IP address it was issued to), the attacker can copy that cookie into his own browser session and have the same logged in privileges as you. You'd be safer if retrieving each secure page meant re-authenticating again, but even then, the attacker can view every page you do.
Jan
31
comment Securely storing an encryption key on AWS
AWS does not use off the shelf Dell hardware, and they securely delete data from decommissioned disks: AWS uses the techniques detailed in DoD 5220.22-M (“National Industrial Security Program Operating Manual “) or NIST 800-88 (“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process
Jan
31
comment Securely storing an encryption key on AWS
@codin AWS can be part of a HIPAA compliant environment to run applications covered under HIPAA guidelines, so apparently they have the policies and procedures in place to be trusted to process private data. (assuming that your own policies and procedures are in place). They have additional security certifications as well.
Jan
30
comment Are partially typed passwords a potential security risk?
An 8 character password is already not very secure and if someone managed to steal your password hash, it wouldn't take long to brute force it.
Jan
23
comment How do I store a swipe pattern in a password manager?
@Jakuje - he's not suggesting using the shape of the letter to remember the pattern, but to number the dots 1 - 9 and use the those numbers to describe the pattern. He just mentioned the "Z" because that's the shape of his sample pattern. Using the numbers, a "diagonal pattern Z" would be 7895123. The only ambiguity is remembering how the dots are numbered (i.e. with 123 at the top like a phone keypad or at the bottom like a computer or calculator keypad). The answer would probably be more clear if the diagram included the numbers for each position.
Jan
12
comment Overwriting only Free Space with rubbish data to prevent data recovery?
I don't think the cipher command wipes just free space that was allocated for that specific folder, it wipes all free space on the entire drive that folder is on. From the MS support site: Type cipher /w:'folder', and then press ENTER, where folder is optional and can be any folder in a local volume that you want to clean. For example, the cipher /w:c:\test command causes the deallocated space on drive C: to be overwritten. If c:\test is a mount point or points to a folder in another volume, deallocated space on that volume will be cleaned.
Jan
12
comment Secure data by encrypting and rewriting on same file
I think you have it backwards - thanks to wear leveling, even if you rewrite the "same" blocks on an SSD, the controller may write the data someplace completely different, leaving the old data intact (which may or may not be recoverable using low level tools). Even a magnetic hard drive might remap sectors leaving your unencrypted data subject to recovery, even if you overwrite all free space. The best way to prevent data from being recovered is to not write it in plain text in the first place.
Jan
9
comment What prevents criminals from buying a new PC and going on public wifi?
If he's tracked back to that public Wifi network, security cameras may have captured him. Or his MAC address may be traceable by the manufacturer to identify him. (so he should spoof his MAC and not be in plain sight when using that public Wifi, perhaps using a high gain antenna to let him stay far away from the access point)
Jan
7
comment TLS Bicycle Attack - What cipher is free from flaws to use?
@SEJPM - Why can't crypto hide the message length either deliberately or as a side effect? Encfs can round up filenames to the block size of the encryption cipher. So, for example, with a blocksize of 16, an attacker can't tell the difference between a single character filename and a 16 character filename (which might otherwise leak enough information for an attacker to find the file he's seeking)
Jan
7
awarded  Popular Question
Dec
30
revised Why did the Papal conclave use a Faraday cage in 2013 when selecting the new pope?
Added anecdote
Dec
30
suggested approved edit on Why did the Papal conclave use a Faraday cage in 2013 when selecting the new pope?
Dec
8
comment Prove ownership of a GMail account
@lserni - if you are sending the email, you can guarantee on-the-wire encryption
Nov
25
comment Writing my own encryption algorithm
While C# is sufficient to write a security algorithm, I use brainf*ck to write my encryption algorithms because it provides further security by obscuring the algorithm. And there's no security like obscurity!
Nov
23
comment Is there a way to prove some content came from a specific website?
Ask a reputable third party to do it (like an attorney) who will swear to its authenticity.