366 reputation
14
bio website kromey.us
location Fairbanks, AK
age 31
visits member for 3 years, 8 months
seen 2 days ago

A (not-so-)humble sys admin from the Land of the Midnight Sun with delusions of being a writer, just trying to stay warm!


Dec
11
comment What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?
@RobIII Sure, and I didn't/don't contest that (well, other than that the simple fact of communicating via encrypted channels is not incriminating...), I was just pointing out that "what you've been talking about" is only available if you make it available, i.e. put it outside the encrypted medium yourself. That you talk to Alice is of course available, and I never argued that; what you said to her, however, is not -- not unless you (or her) screw up.
Dec
11
comment What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?
@jww They only get to see what you've been talking about if you put "Our secret plan to topple the Taliban" in the Subject line. If you instead put "Grandma's top-secret muffin recipe" there, then no, they don't know that you're actually talking about Grandma's top-secret chicken pot pie recipe!
Dec
5
awarded  Commentator
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas It works for me. I guess if you can't see it, you'll just have to trust me that it totally validates everything I've said, and also proves incontrovertibly that apples are the far superior fruit! Or I can just copy/paste the link here without formatting in the hopes that this will work for you: codeproject.com/Articles/670373/…
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas In many cases that's how it is done, yes (e.g. when you compile a program with debug options), but that's not always the case, especially in the example of modders hacking on a game not designed for modding. It does (barring a bug/flaw in the OS) require elevated privileges, however. Here's one example; without modifying notepad.exe, it shows how to do it with simple code. And, again, it's dependent upon permissions in the OS, but root/admin could do this for any process.
Dec
5
comment Is data-remanence a concern in RAM?
It's the "sufficient privileges" bit that's important, hence why I stressed in my answer not running untrusted programs with elevated privileges.
Dec
5
comment Is data-remanence a concern in RAM?
@Celeritas Sometimes there can be a bug, yes. There are, however, ways around the segfault; it's been a long time since I've coded at that low a level, and I no longer remember the specifics, but a process with sufficient privileges can read memory allocated to other processes without provoking a segfault. This is how, for example, many debuggers work, as well as a key tool in modding games that are not generally moddable involves doing the same thing -- basically grabbing dumps of the game's RAM so would-be modders can hack it.
Dec
4
answered Is data-remanence a concern in RAM?
Oct
7
awarded  Autobiographer
Sep
30
answered Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated?
Apr
13
awarded  Yearling
Jun
24
comment moving from MD5 to SHA-512
See, for example, the answer to this question: security.stackexchange.com/questions/4687/…
Jun
24
comment moving from MD5 to SHA-512
@Justin You could also just leave the "upgrade" code in place -- 3 years later (when my web app finally came down), the code to add salts to passwords that didn't have them was still there. There's actually a case to be made that more involved authentication procedures -- which take longer to complete -- improve security by naturally limiting the number of brute force attempts in a given period of time; this is why you'll see suggestions to hash passwords repeatedly instead of just once (although that's primarily to hinder off-line attacks if someone gets your database).
Jun
24
awarded  Teacher
Jun
24
comment PCI restrictions on using using (hashed) credit card number to identify a repeat customer?
PCI permits the storage and use of the first 5 digits (which identify the type of card) and last 4 digits of a credit card number. This is almost always enough to uniquely identify a transaction and, through that, the customer who made said transaction; it is not enough information, however, to use the card number. I know of at least one software product that does exactly this, however NDA prohibits me from saying what product or even what market said product is in.
Jun
24
answered moving from MD5 to SHA-512
May
19
comment homomorphic encryption and DARPA
Wow. Really? Wow! The more I learn about cryptography, the more it just blows me away!!
Apr
14
comment How to protect data on a thumb drive
Ah, okay. So, still too dangerous to have around my home, unless I'm just that eager for a new paperweight...
Apr
13
comment How to protect data on a thumb drive
That's an option? Everything I'd read about the Ironkey has suggested it was an always-on feature, which is what has kept me from getting one -- I have a wife, a sister, and a sister-in-law who all love trying over and over and over to crack my passwords, so an Ironkey wouldn't last long at all in my home!
Apr
13
awarded  Supporter