Reputation
1,431
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
9 17
Impact
~96k people reached

1h
awarded  Autobiographer
Aug
24
comment How to make sure my data is secure even if someone gains physical access?
The answer to "is it enough to...?" depends very much on the threat model. A sophisticated attacker would be trivially able to, say, replace the keyboard driver with one that logs all key strokes, thereby gaining access to the passphrase you use to unlock your second hard disk. A casual snooper likely wouldn't. So: what's your threat model?
Aug
20
comment Is there any way to securely hide data on physical media?
xkcd.com/538
Aug
20
comment Is there any way to securely hide data on physical media?
OP's threat model includes the problem that "the files are still accessible by anyone who comes across the directories or scans the drive for information". This implies that the attack is performed while the computer is running. In that scenario, FDE buys you nothing. FDE protects data at rest while the container is locked (or rather, not unlocked, as it is usually the unlocking that is an active step). Additionally, FDE hardly offers "full plausible deniability". See e.g. LUKS FAQ section 5.18.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
@MasonWheeler Google for ford electronic key recall gives 502k hits. Have fun.
Aug
12
comment What artifacts to acquire when looking for IoC?
I only edited the question to fix the incorrect formatting. You still need to edit the question further. As it stands, it is highly likely to be put on hold and possibly closed. See my comments above.
Aug
12
comment What artifacts to acquire when looking for IoC?
Also, we prefer it when questions can be authoritatively answered. Yours seems to be very much about peoples' opinions ("what can I do to improve the script? do you suggest...?") as well as open-ended ("what else should I be looking for?"). I would recommend that you read through How do I ask a good question? in our help center, and then edit your question to try to make it conform to our standards.
Aug
10
comment Why do people use IP address bans when IP addresses often change?
@KevinFegan It's a commonly held misunderstanding (and/or oversimplication) that (for example) "class C" simply meant a network mask length of 24 bits. Class C addresses were IP addresses that began with 110 binary (first octet 192 through 223), and this range was subdivided into 2^21 networks of 2^8 hosts each. (3 + 21 + 8 = 32 bits of IP address.) en.wikipedia.org/wiki/… has a summary, and RFC 791 (see page 24) is the authoritative reference.
Aug
10
comment Why do people use IP address bans when IP addresses often change?
@KevinFegan 10.9.8.0/24 was not a class C in classful routing; it was a small portion of the class A network we now refer to as 10.0.0.0/8. When the first octet had the value 0 through 127, that was a class A network, equivalent to a /8 in classless routing.
Aug
10
comment Why do people use IP address bans when IP addresses often change?
@SakamakiIzayoi /8 means an 8-bit netmask. In other words, 1.1.1.0/8 covers 1.0.0.0 through 1.255.255.255. You probably meant /24, which would cover 1.1.1.0 through 1.1.1.255.
Aug
1
revised Why is it dangerous when an attacker can control the `n` parameter to `memcpy()`?
added 83 characters in body
Aug
1
revised How do I know my tools aren't compromised?
Be a little less assertive about NSA's M.O.
Aug
1
revised Is there any way to determine the location of a laptop based on its MAC address or serial number?
added 1006 characters in body
Jul
17
comment Use the same password on different (very secure) sites?
You can suppose that if you want to. Personally, I use a password manager and strong, unique passwords everywhere; then a compromise (of anything other than the password manager database and corresponding master passphrase) only ever affects a single account, and I don't need to determine whether a particular site is likely to follow security best practices or not.
Jul
14
comment Is this RSA/AES combination good?
Fair enough, there. But in this particular instance, maybe you want to be slightly more explicit and say "use a modern/standardized variant of SSL"? Anyway, minor detail in the grand scheme of things.
Jul
14
comment Is this RSA/AES combination good?
As for (4), I'm not sure which is worse: storing passwords in plain text, or (at least in the eyes of an active attacker essentially, and certainly for the server) sending them in plain text...
Jul
14
comment Is this RSA/AES combination good?
Surely you mean TLS and not SSL. Wikipedia: Transport Layer Security: SSL 1.0, 2.0 and 3.0 "As of 2014 the 3.0 version of SSL is considered insecure..." "SSL 2.0 is deprecated..." "SSL 3.0 is deprecated..."
Jul
14
awarded  Caucus
Jul
10
revised ProtonMail security concerns
added 163 characters in body
Jun
21
comment Does verifying identity by positions in passwords mean passwords are stored unhashed?
@Kevin I agree that most of Unicode would not be candidates for any given password, but my comment was meant to illustrate the best (for some definition of "best") case. The Unicode code space allows for a bit over 1M code points, hence that's the figure I used. The point was how much of a reduction of password security that is, not the exact number of possibilities to consider for each character position. It doesn't matter really even if the number of possible code points per character is 100x larger or smaller, because that still is only going to make a tiny dent in the conclusion.