Reputation
502
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 8
Newest
 Caucus
Impact
~11k people reached

  • 0 posts edited
  • 0 helpful flags
  • 19 votes cast
Aug
14
comment Preventing Ethernet over power
(Cameras just monitoring the door so that if anything unwanted is later found you can check who might have left it are a lot cheaper than a guard though. Unless Tom Cruise is dangling from your air vents to avoid the door and cameras.)
Aug
14
comment Preventing Ethernet over power
Though you then have the problem that if whatever is in the room is classified, anyone monitoring a live feed from the cameras has to be cleared to see anything that might become visible, and the feed is another thing that penetrates the room boundary to worry about. Recording cameras where the recording can be viewed inside the room (or some other secure location) if something needs to be reviewed later are another option, but don't help at the time. If it really has to be this secure, the OP probably isn't allowed to give details.
Aug
12
comment Preventing Ethernet over power
That's why I said "Obviously you can combine this with filters on the power line" :-)
Aug
12
comment Preventing Ethernet over power
(Of course it also assumes/requires that authorised users of the room will tolerate that sort of treatment.)
Aug
12
answered Preventing Ethernet over power
Jul
21
awarded  Caucus
Apr
15
comment Why does the user pick the password?
@Vality - that's not entirely true. If I pick a weak password on a web service, anyone in the world can try and guess it. If I use a strong password and write it on a post-it note on my monitor at work, a very small number of people I generally have to trust anyway have access to it. If I write it down in a password manager application that's protected by a password I don't write down, it's even harder for anyone else to access.
Mar
26
comment Hide the fact of e-mail communication
@vojta - I think that "when not overcoming any obstacles" is a spurious qualification, and that the UK's Computer Misuse Act 1990 doesn't say anything about overcoming obstacles to gain unauthorised access anyway. There are situations where Eve might have authorised access to all the potential girlfriend's mail and is merely abusing it, but it's unlikely.
Mar
25
comment Hide the fact of e-mail communication
I know you said divorce is not an answer, but Eve monitoring Alice's mail (and all the other potential girlfriends) is almost certainly a criminal offence. Bob can probably use that as justification for a divorce, and once Alice is in jail she can't monitor Bob any more.
Mar
25
comment Hide the fact of e-mail communication
@sebleblanc But with the problem as stated, Alice will start suspecting Bob is married if he stops using the email address she (and Alice) already know as Bob's. Even if her boss is also called Bob, the pseudonym is going to be hard to pull off without Eve actively co-operating.
Mar
20
comment Can an old operating system webserver be made secure?
He could run a user-space TCP stack and ignore the OS one completely, at least in theory....
Mar
18
comment Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?
Sorry, I don't have any suggestions. But at least you now have an existence proof that a PKCS#11 implementation can allow unbounded private key export, only protected with an externally provided AES key, with a FIPS 140-2 level 3 HSM.
Mar
18
answered Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?
Mar
13
comment Is it legal to start a private website for you and your friends to hack?
As well as the free level of CTF365, you could try microcorruption.com/about (and/or forthcoming kalzumeus.com/2015/03/09/announcing-starfighter)
Mar
13
comment Why for some SSL websites browsers show extra info, while for others dont
Might be worth adding an explicit statement that "EV" stands for "Extended Validation", and there are guidelines for them defined by the CA/Browser Forum, so CAs and browser manufacturers agree what is meant. en.wikipedia.org/wiki/Extended_Validation_Certificate
Mar
9
comment How to estimate the time needed to crack RSA encryption?
Some years later, 512 bits is down to "about 7.5 hours": blog.cryptographyengineering.com/2015/03/… (Typical users still aren't anywhere near breaking 1024-bit keys, and won't be within the remaining time of the "ten years" of the answer. The sort of organizations who might possibly be don't make public announcements: crypto.stackexchange.com/a/1982/5249)
Jan
31
awarded  Yearling
Jan
2
comment How can I know that the CA certificates in my computer have not been spoofed?
They don't have to manipulate the browser, they can edit the results page from GRC so that they appear to match. That's unlikely, but to test against it you need to compare with a machine outside the employer's network. (Also, there are legitimate (but unlikely) scenarios where you will get a mismatch - if the site is actually using multiple load balanced servers around the world, they could use different valid certificates for different machines. Or a server might have both RSA and ECDSA signed certificates, and your browser use one that GRC doesn't ask for.)
Oct
20
revised How can I know that the CA certificates in my computer have not been spoofed?
Updated dead link
Oct
15
comment SSL3 “POODLE” Vulnerability
The SSL 3.0 symmetric cipher that doesn't use CBC mode is RC4, which may well be disabled for reasons also well explained by Thomas (and the NULL "cipher") - security.stackexchange.com/questions/32497/tls-rc4-or-not-rc4/…