144 reputation
5
bio website
location
age
visits member for 1 year, 9 months
seen 22 hours ago

Jun
25
comment Password strength and banks 4 pin code?
I have multiple german EC Cards, and none of them has a 6 digit pin (4 for all)
Jan
27
comment How did the spammers get this address?
Some webservers have a "contact admin" feature on Error 404. Could that be it?
Jan
10
comment What are the pros and cons of using a password safe instead of writing passwords on paper?
"paper won't break down like computers do" .. actually it might get destroyed. For example in a fire (even in a safe)
Oct
14
comment How secure is Android's facial recognition?
I don't know what version or phone that was anymore, but we played around some weeks ago with a regular photo displayed on a second smartphone. It unlocked with no problem.
Sep
3
awarded  Commentator
Sep
3
comment Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?
If I understood correctly, he wants to be able to use the phone as usual, but if he opens "app a" then there should be no way of getting out of it without the password. What you describe for iOS seems to be far harder/slower to activate/deactivate.
Aug
22
comment Forgotten password or reset link, which is more secure to email?
In addition to the "stolen database" scenario, anyone with access to the database can see those passwords. This might be just you, any admin, any developer, or even any employee. As many users use the same password everywhere, there might be very tempting scenarios and someone might get weak and use one of the passwords. You really do not want to be responsible for that happening.
Aug
19
comment Who tells that TrueCrypt is secure?
+1, but 100 seems a rather low number to show how secure this is. I'm not sure what is possible right now, but even if you can calculate 1.000.000.000 tries per second, the number of years it takes is ridiculous.
Jul
15
comment Intercepting and reading SSL traffic generated by Android
Apps might have hardcoded certificates or thumbprints and only communicate with a server that has exactly the expected certificate. If an app works that way, the only way to get it to run with your certificate would be reverse-engineering and modifying it.
Jul
12
awarded  Critic
Mar
6
comment Is it possible to locate Tor/proxy users? Spam is getting on my nerves
+1 for "treat as spam rather than TOR problem". captcha will annoy all users, and if the spammer spams manually this wont bother him him too much
Mar
6
comment Is it possible to locate Tor/proxy users? Spam is getting on my nerves
Are you aware of the fact that there are free disposable spam email adresses? (first hit on google: spambog.com/en no affiliation) If the guy knows that, this will have near zero impact. You could of course ask for the scan of an ID or something, but this will get you in trouble with regular users who are pissed by something like that. If there are very distinct spam patterns, why not try to filter posted content by like show a new post as "Currently under review" only if it is hit by the filter.
Feb
6
accepted How to secure a certificate internally
Feb
6
comment How to secure a certificate internally
Thats what I thought. HSM sounds nice, thanks for pointing at that.
Feb
5
asked How to secure a certificate internally
Jan
10
awarded  Scholar
Jan
10
accepted How to verify certificate with very little information
Jan
10
comment How to verify certificate with very little information
Jea. Have no idea how hard bruteforce-creating certificates until 48bits of fingerprint match is, but even if 2^48 does sound quite big, it still doesnt feel super secure. But SRP seems to be exactly the right thing for this. :)
Jan
10
comment How to verify certificate with very little information
Thanks, this SRP sounds really good, im gonna look into that. Not true bytes, but 8 characters in base62 (only signs and numbers, should be readable token) which should result in 11 hex-chars or 44bit. Maybe even 12 hex-chars/48bit if base64 is possible.
Jan
10
comment How to verify certificate with very little information
But you still cant verify if the server is the server, so the client registers with the fake server, and then the fake server could act as a client and register with the real server. Not sending over the clientcertificate sounds good, but the problematic situation is before any of this happens.