Reputation
2,031
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
12 23
Newest
 Yearling
Impact
~116k people reached

1d
comment What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?
"It establishes a minimum age of the blockhash" To the extent that you trust the key and signature timestamps to establish the key's creation date. In this case (lots of signatures, including automated signatures by widely trusted keys like PGP Global Directory Verification Key) it's probably a reasonably safe bet, but on a key with perhaps only a self-signature, not so much.
1d
comment What are the alternatives to door passcodes?
@RobertMennell Might it be a geographical difference? (My reference is mostly western Europe, living in Sweden but having travelled some.)
1d
comment What are the alternatives to door passcodes?
@RobertMennell Yes, you can have auto-locking doors with key locks. I did where I lived in the early 1990s. However, I don't think I have ever come across that since. Except in padlocks, of course, where it is a common feature and where manual locking is the exception. I'm not saying automatically locking door locks don't exist, but rather that if you are going to use a metaphor, it makes sense to use one that more people are likely to intuitively understand. Abstractions are leaky, but that's no reason to drop a bucket of water on the floor.
1d
revised Are files deleted before encrypting then formatted able to be retrieved?
added 42 characters in body
1d
answered Are files deleted before encrypting then formatted able to be retrieved?
1d
comment What are the alternatives to door passcodes?
I wouldn't compare door locks and keys to public key cryptography. If anything, I like to use the metaphor of padlock and key for public key cryptography. Ordinary (non-auto-locking) door locks is more similar to symmetric cryptography because the same key is (traditionally) needed for both locking and unlocking. Padlocks: Alice puts secret in box, puts padlock on box, Bob gets box and uses key to unlock padlock. Doors: Alice puts a secret inside, uses her key to lock the door, and Bob uses his identical key to unlock the door to gain access to the secret. Both are valid, but different.
Apr
19
comment Are cloud storage services a good strategy to protect against ransomware attacks?
There is nothing wrong about encryption, as long as you have the decryption key. In fact, I would argue the same as you that encryption before uploading to the cloud should be the default, to be disabled only in specific cases where local encryption simply isn't feasible for the use case in question.
Apr
19
comment How well does FDE protect against disk firmware malware?
Related: How can the Equation Group HDD firmware malware help bypass FDE?
Apr
19
revised How well does FDE protect against disk firmware malware?
Better title, better tags
Apr
19
comment Is this information leakage dangerous?
Or configure the web server to not emit the data in error reports, HTTP headers, etc. Which is usually a good idea unless you have some specific reason to make the data publicly available...
Apr
19
comment What should you do if you catch ransomware mid-operation?
@Joshua Yes, assuming that the same key is used for every file. Otherwise, you may very well get a useful key, but that key will only be useful for the one (or a very small number of) files that were being encrypted at that point. I'm reluctant to give malware authors too many ideas, but if I can think of ways to defeat such a scheme even while allowing for dumping RAM to disk (hibernation) then it can't be that hard. (Though CodesInChaos already did, and my earlier comment may qualify...)
Apr
19
awarded  Yearling
Apr
19
comment HTTPS web service switched to HTTP. What can go wrong?
Stack Exchange offers HTTPS for all non-meta sites. (Meta is more complicated because of the domain name structure; should have gone with security.meta.stackexchange.com rather than meta.security.stackexchange.com because then it could have been handled largely by *.stackexchange.com and *.meta.stackexchange.com.) I think EFF's HTTPS Everywhere gives you HTTPS by default for all Stack Exchange main sites.
Apr
19
comment HTTPS web service switched to HTTP. What can go wrong?
Even paid certificates can be had for nearly nominal amounts, if for some reason you want to pay (if only to have someone to yell at when things go wrong). It isn't difficult to find basic DV certs in the sub-$10/year/fqdn range, or tack on maybe an extra zero if you want something like a wildcard cert, and for anything where you'd even consider HTTP, DV HTTPS is perfectly sufficient.
Apr
18
comment What should you do if you catch ransomware mid-operation?
Hibernating to get a copy of the key is a good idea, but it only really helps if the key used for encryption is also useful for decryption. If the ransomware is written to generate a new symmetric key for each file, and encrypt those with a public key (the way for example PGP/GnuPG works), then the private key needed to decrypt the file-specific keys might no longer be in memory; it may have been handed off to a remote server already. That said, it seems unlikely that this could hurt (any more than what the user would already be going through), and it just might help.
Apr
16
comment Shutdown if case opened
@user5510281 The threat model stated in the question did not include elongenated metallic objects going through heads at high speed. It's not fair to downvote answers because they do not cater to extreme cases that weren't even included in the question.
Apr
16
comment How can I protect my home/office computer against row hammer?
From Wikipedia: "This circumvention of the isolation between DRAM memory cells results from the high cell density in modern DRAM" So how about using less dense memory chips? Of course, that comes with its own set of problems.
Apr
13
comment Why does one need a high level of privacy/anonymity for legal activities?
What Snowden did say was that (possibly paraphrased, but much closer than the quote you gave) "saying you don't care about privacy because you have nothing to hide is like saying you don't care about free speech because you have nothing to say".
Apr
12
comment Secure HttpOnly Cookie or Header field for auth token securing an API?
Cookies are transferred in HTTP header fields. So technically there is potentially very little distinction between the two.
Apr
11
revised How to determine if a VPN provider respects data confidentiality?
Better title