942 reputation
713
bio website michael.kjorling.se
location
age
visits member for 3 years, 8 months
seen 18 hours ago

Dec
15
comment Good, simple list of reasons that email is inherently insecure
"Nobody will know the difference" is a bit of a misnomer. While the difference might not be obvious, if there are signs to make someone suspicious of the origin of the email, the trace headers (especially when compared to other emails from the same alleged sender) will provide fairly conclusive evidence to at least whether the same ISP was used to send both emails. (Now, a lot of the time these days, that ISP is actually Gmail, which by itself doesn't tell you much of anything...)
Dec
8
comment Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
"If possible, only assemble the secret in intermediate values rather than any named variables" This doesn't make much sense as most release-compiled binaries don't include naming information. If I disassemble a C++ compiled application, I will be able to tell what instructions it executes, but I almost certainly won't be able to tell any variable names.
Dec
4
comment What are the laws regarding ISP recording IP addresses? How would they know who had which?
The Data Retention directive was declared invalid in April 2014. Wikipedia and one specific source Court of Justice of the European Union Press Release No 54/14.
Dec
3
awarded  Pundit
Dec
2
comment Do I have to hash users' IP addresses when I log them?
There are only about 4.3 billion possible IPv4 addresses. (Sure it gets "better" if you allow IPv6.) Without knowing the hashing algorithm in use, I dare say a few hours on a single PC and maybe 1-2 TB storage would be plenty to provide a lookup table for every IP address hash. Storage might even be slower than direct hashing (unless you go SSD and basically store hashtables rather than lists).
Dec
2
comment Do I have to hash users' IP addresses when I log them?
Related: How secure can IP based login be?
Dec
2
comment Do I have to hash users' IP addresses when I log them?
Why? What threat are you trying to protect against? Without a threat profile or attack vector, how would we judge whether hashing IPs might be a suitable and effective response to the threat?
Dec
2
comment Relationship between Anonymity and Untraceability
Isn't Bitcoin pseudonymous rather than anonymous? That is, all transactions involving a specific identity share that identity (a pseudonym), but there might be no easy way to connect that identity to a real-life identity (a person).
Dec
2
awarded  Nice Question
Dec
1
comment Can bankers' rounding be exploited to maliciously increase balances?
I doubt the school class mentioned by jknappen needed (or had) source code level access.
Nov
28
comment Password Storage - Self Encryption vs Hashing?
@MarcksThomas Next step up is 16-round ROT13.
Nov
27
comment Can a lock picker slowly undermine the security of a deadbolt door?
When you say Mortise lock, do you really mean something more like a lever tumbler lock? I could be wrong, but it seems Mortise is more about the form factor than the type of actual lock and key.
Nov
27
comment Password Storage - Self Encryption vs Hashing?
As linked to by Nefrubyr, it sounds like you've just basically reinvented crypt(3).
Nov
19
revised How secure is GnuPG conventional encryption (with defaults)?
Better title
Nov
19
comment What are the benefits of encryption for everyday people?
In all honesty, #2 is much easier by just sending an email with a faked From: header. 99.9% of people won't even notice. SPF and friends work to partially mitigate this, but far from every recieving server acts on those.
Nov
19
suggested approved edit on How secure is GnuPG conventional encryption (with defaults)?
Nov
12
comment Password Management within an Organisation
This looks like more or less what pass does.
Nov
11
awarded  Scholar
Nov
11
accepted Is publishing CRLs over HTTP a potential vulnerability?
Nov
8
revised Is publishing CRLs over HTTP a potential vulnerability?
added 64 characters in body