210 reputation
16
bio website
location
age
visits member for 1 year, 4 months
seen Nov 12 '13 at 0:10

Dec
21
awarded  Yearling
Jul
31
comment Avoiding MITM attacks when using HTTPS over mobile
@marccenedelia You can't protect yourself against that, as your information is being leaked between the server and any client - not necessarily yours. The company in question has to make sure that it doesn't hand out more info than absolutely required to clients. In the case of the service in question here, the amount of information required to run the service is already more than many people would be willing to part with. If you are one of them, your only protection is not using such services at all.
Jun
1
comment Why can a Tor exit node decrypt data, but not the entry node?
@szx How would that help? If you, as a client, received data encrypted with a node's public key, you could not decrypt it.
May
31
comment Why can a Tor exit node decrypt data, but not the entry node?
@MayankSharma I get that, but how does that work for the data on the return path, i.e. on the way from node C back to the client?! How is the data that is going from node A to the client encrypted?
May
28
comment Why can a Tor exit node decrypt data, but not the entry node?
@MayankSharma Maybe I'm being silly: So how are packets encrypted on the return path? If they're simply encrypted with the nodes' private keys, then any packet caught between two nodes could be decrypted rather easily by anyone with a snapshot of the node pubkeys at that time?!
Mar
8
comment Is advanced mathematics relevant to security beyond cryptography?
Alan Turing did not get a Nobel prize in math, for the simple reason that there has never been a Nobel prize in math.
Mar
6
comment Is it possible to locate Tor/proxy users? Spam is getting on my nerves
If it's one guy, not a legion of spammers, then that's an issue of psychology rather than a technical one in my opinion. Your forum probably already has a "flag for moderator attention" button, use that and a quick look over new posts every few days and swiftly delete such spam. Do NOT reply to it, and NEVER show that it bothers you. The spammer will get bored and lose interest very quickly.
Feb
10
comment How do I know a piece of software only does what the author claims?
"The cook has a vested business interest in his customer not being dead." I swear, if I ever write an introductory textbook on business economics (likely never, but hey), this sentence will be in there.
Jan
31
comment How to tell if you're being ARP poisoned?
How reliable is the traceroute method? I would imagine there might be ARP poisoning toolkits that don't increment the hop count on packets they inspect and forward. Those would be invisible to traceroute.
Jan
12
comment How disable Java in Chrome 23?
It may have an unexpected name in your chrome://plugins tab. On my system (Kubuntu 12.10) the relevant plugin is called IcedTea, with a small note in the description that it's responsible for java applets.
Jan
11
comment What is Non-Repudiation of content? How can we combat it?
"The security of the email account needs to be protected" - why? I thought the point was that as long as you keep your private key secure, no attacker can sign a message in a way that makes it to appear like you sent it, even if they can have access to your mail account (like a malevolent mail server admin, or a security breach at your mail provider).
Jan
3
awarded  Critic
Jan
2
comment Wifi login redirect applications
@AJHenderson If you're using the first method, does that mean that someone who doesn't want to pay for Wifi access somewhere can just listen to traffic and change their MAC address to one which is obviously authenticated at that moment?
Jan
2
comment Are older viruses removed from virus definition files?
+1 An interesting question. I would hope that AV definitions for fileservers etc never lose signatures, however old they are. For home user/desktop AV, you could probably drop signatures of all malware that won't run on any OS older than the oldest one supported by the AV software.
Jan
2
comment Why CAs instead of global fingerprint database?
There are still two points of failure, the OS maintenance team and the global DB. Unless you expect each OS to have their own 'global DB', in which case it isn't global anymore and everyone acquiring a new cert would have to talk to a couple hundred OS maintainers. And you still haven't adressed why your global DB is not 'too big to fail'. Right now, we can let a CA go down/bankrupt if they screw up, even if it's difficult to manage. If the global DB is compromised and loses people's trust, there is no alternative anymore.
Jan
1
comment Why CAs instead of global fingerprint database?
@User145678: Even if it were feasible, I'm still not sure how your proposed system makes things better. At the moment, you have to trust your browser vendor to supply a valid list of root certs, and then you can choose which of these to trust. Under your system, you'd have to trust your OS vendor and a single global fingerprint provider. In my eyes, this makes the trust problem and the 'too big to fail' problem worse in both cases, not better.
Jan
1
awarded  Commentator
Jan
1
comment Why CAs instead of global fingerprint database?
Wait, so you are suggesting that every OS ships with millions and millions of fingerprints for every website that uses certificates? That's impratical because of (1) the sheer volume and (2) turnaround/update times.
Jan
1
awarded  Citizen Patrol
Dec
30
answered OS fingerprinting: can I rely on the results?