Reputation
623
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
6 12
Newest
 Pundit
Impact
~8k people reached

2d
awarded  Pundit
2d
comment To what extent does formatting a disk (securely) remove its data?
"It used to be that recovering 5-6 times overwritten data was kinda tedious, but otherwise absolutely no problem." From what I've read, this is more of an urban legend than fact, with no more support than a single researcher's theoretical claims to support it. Do you have any references to support it ever being "tedious but no problem" to recover data from a single-pass randomized overwrite? This is the best resource I have found supporting the opposite, but I'm happy to be proven otherwise: web.archive.org/web/20121110053501/http://grot.com/wordpress/…
Apr
25
awarded  Yearling
Mar
17
comment Why would a website that resets your password to one of their choice be considered a plain text offender?
Interesting. I know I get impatient waiting 15 seconds for a reset link to show up in my gmail box. I think I'd go nuts waiting for a letter to arrive! lol
Mar
2
comment What is DROWN and how does it work?
Not sure I'm quite ready to talk about network protocol attacks in terms of "late Nth century" yet. ;-)
Feb
17
comment Why can't the FBI copy the contents of an iPhone they are trying to crack?
@Ben: Yes, crypto "done right" still lets you sleep at night even if the bad guys (or FBI in this case) get your hardware. The issue here is that the encryption keys are protected by a 4-digit PIN (basically a "mini-password"), which is easy to brute-force. In order to counter this, Apple wipes the stored encryption keys after some X failed attempts. What law enforcement is requesting is a new firmware which allows infinite attempts. They have also asked for some facility to run through the brute force quickly (rather than paying some FBI intern $15/hr to hammer through all 10k possibilities)
Feb
17
comment Why can't the FBI copy the contents of an iPhone they are trying to crack?
@Ben: Sidenote: I don't think the data itself is wiped, but rather the decryption keys. With strong encryption, wiping the keys alone is effectively the same as wiping all of the data, only much quicker and easier (you don't have to write gigabytes of data - only a few kilobytes)
Feb
4
comment Why are self signed certificates not trusted and is there a way to make them trusted?
@CristianTM: Often when someone "STFW" for an answer to a question, StackExchange is the top result - which is great and speaks highly of StackExchange! I don't think it's a legitimate reason to disqualify a question from being posted here. BadSkillz' answer below it simple, useful, and may drive this very page to the top of everyone's search results on the topic -- AND it took his as long to produce it as it took you to post your comment. :-)
Jan
26
comment Why did customer services say using symbols in a password is insecure?
They're savvy enough to care about SQL injection, but think the solution is to disallow certain characters in users' passwords? I smell a disconnect here, like a security officer somewhere knows just enough to be responsible for--but very careless with--a lot of users' data.
Jan
26
comment Why did customer services say using symbols in a password is insecure?
@iProgram: "To make sure they have better security in the future I did educate them and said that..." Call me cynical, but I doubt your comments were remembered for more than three seconds after the phone call ended. :-)
Jan
20
revised Is it possible to secretly monitor/backdoor hardware?
Removed unnecessary conversational bits, as well as assurance for the motivations behind the question
Jan
20
suggested approved edit on Is it possible to secretly monitor/backdoor hardware?
Nov
18
awarded  Teacher
Nov
17
answered Preventing registered users from sharing passwords
Nov
16
awarded  Popular Question
Oct
27
awarded  Nice Question
Sep
26
accepted Should I be worried if I accidentally entered my password in a username field?
Sep
26
comment Should I be worried if I accidentally entered my password in a username field?
@Rudy: True, but that observation is only useful for sites I have control over. 😉
Sep
25
asked Should I be worried if I accidentally entered my password in a username field?
Aug
28
comment How does a hacker know how many times a password was hashed?
Not really a direct answer, but ideal security architecture works even when the attacker has full access to all implementation details (including hashing round counts). So the assumption that the attacker knows how many rounds were used is not necessarily because it's common, but rather that it's always good to make WORST CASE assumptions when it comes to security.