870 reputation
311
bio website
location California
age
visits member for 2 years, 8 months
seen 8 hours ago

2d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
You can't just "encrypt" a string using SSL and pass it to any webserver's SSL port at-is. SSL is a protocol that involves active handshaking between the sender and receiver, so you have to use an SSL client to talk to an SSL server.
2d
comment How secure is VOIP?
And if he is being specifically targeted, it's probably easier for a thief to tap into an analog phone line either through the demarc box on the back of his house or the telco junction box out on the street than to tap his VoIP calls. Back when long distance was expensive, I had someone tap into my demarc box to make international calls during the day when I was at work - nearly $1000 worth of calls in a month. The Telco replaced it with a locked box and that took care of the problem (they probably just moved to the neighbor's house)
Jul
22
comment Fake UserAgent visitor attack?
@DmitryGrigoryev - agreed - while it's possible to combine dictionary words to make a strong password, it's hard to get users to understand that they have to be randomly selected, not common phrases. Even after showing them the xkcd comic often people will say "Oh you mean like 'darksideofthemoon' or 'closebutnocigar'?"
Jul
20
comment Should I implement incorrect password delay in a website or a webservice?
I don't think that have an artificial pause for failed login attempts makes the server more susceptible to DoS attacks than if it returned immediately - a server is likely no worse of having 1000 threads sleeping for 10 seconds before returning a bad password error is probably no worse than 1000 (or even 100) CPU bound threads actively calculating a password hash and consuming all of the CPU on the server.
Jul
16
comment Could anyone technically see my requests with TOR if the person has access to my router?
While your answer is factually correct, it doesn't really answer the question unless the asker happens to know the difference between an entry node and an exit node (and many, perhaps most, Tor users do not).
Jul
10
awarded  Enlightened
Jul
10
awarded  Nice Answer
Jul
9
revised Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
Add section about email forwarding
Jul
9
comment Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
@SilverlightFox - Good point - thanks! I forgot about email forwarding, I'll add that to my answer for completeness.
Jul
9
answered Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?
Jul
9
comment Secure communication in SHTF
I'll add that if you plan to use ham radio to communicate, you're not legally allowed to use encryption on the ham bands. Maybe you don't care in a SHTF scenario, but if one of your of your scenarios means resisting government corruption/takeover, you probably don't want to so visibly violate the law, which gives the government an excuse to come visit your compound.
Jul
8
comment Secure communication in SHTF
How secure do you need to be? You could use a Book Cipher that uses pages of a book as the OTP, and use some algorithm that can be memorized (like 2 times the date minus the month) to select the page of the book to use as today's OTP so even if someone knows which book you're using, they can't instantly decrypt tomorrow's message. This is not very secure if your adversary has a computer (and even if he doesn't), but it gives you reasonable privacy against a casual listener.
Jun
26
comment What's more secure? Hard coding credentials or storing them in a database?
You may think that an attacker wouldn't believe that the password is stored in code, but he's still going to look at the code to find the database table where the password hashes are stored, so he'll still find it. This is another case of security through obscurity -- don't count on the fact that you're "different" to help protect you, there's plenty of code out there with hard-coded passwords, so no attacker will be surprised to find it in your code.
Jun
20
comment Attacks on encrypted computer?
If you have enough privileged access to the hard drive that you can randomly flip bits, then couldn't you just flip all of the bits on the hard drive?
Jun
20
comment Trying to keep high school students out of the Wi-Fi network
This is the only real solution to the problem of students stealing the Wifi password -- if a teacher's password leaks, then lock out their account and have a talk with the teacher about securing their password.
Jun
6
comment Can a wifi provider decrypt HTTPS usind MITM without users noticing?
@SargeBorsch - the official download link may be HTTPS, but few users would notice if when they went to mozilla.org to find the download, the Wifi operator secretly rewrote that page to redirect the download link to point to their own infected copy of firefox... The official mozilla site may use HTTPS everywhere, but when I search Google for firefox download, the Go to download links points to the mozilla.org page, not the https page, leaving it open to interception.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
@atsby - If we pretended the disks didn't fail, we'd have lost the use of an entire tray of disks in our array since the disks did in fact fail. Since we used full disk encryption, we just sent them back after we swapped in the replacement disks, knowing that the encryption would prevent anyone from recovering data. Without encryption, we'd have had to physically destroy the disks and would have incurred the expensive non-returned disk fees.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
The maintenance contract on our storage array requires that failed disks be sent back to the company after swapping out (or we pay a hefty "non-return" fee on the drives). Without disk encryption, returning disks may not be possible since you can't wipe a failed disk. We had a power supply take out an entire disk tray once -- that would have cost us around $40,000 in non-returned disk fees.
May
9
comment New Gmail login system—going against conventional wisdom?
Lowering support volume is also (usually) more user friendly -- being hard enough to use that a significant number of users need to contact support is the opposite of good usability.
Mar
4
comment How does Android L achieve strong encryption with a low entropy passphrase?
It's worse than that - there are 389112 valid combinations -- some combinations are invalid because you can't skip over an adjacent dot (unless it's already been used. You can reduce the search space even farther by excluding "difficult" combinations that many people might not use.