2,159 reputation
1826
bio website amateurlayman.com
location Lower Hutt, New Zealand
age 46
visits member for 3 years, 11 months
seen Apr 10 at 0:16

A software developer.


Apr
1
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
Hi @MichaelKjörling all of the techniques you mention are outside the scope of the One Time Pad primitive. Note that you introduce another vulnerability above when you consider an attacker conducting a denial of service attack on the communication by forcing the one time pad to be marked as "used".
Mar
25
revised LastPass login security
added 271 characters in body
Mar
17
awarded  Popular Question
Feb
20
answered Why do phones have SIM cards?
Feb
19
comment How does Tor guarantee anonymity of Tor network?
Hi again @KnightOfNi I am a little ahead of actual evidence on this one. The article spiegel.de/international/germany/… references some Snowden docs that shows for Circuit tracing attacks the NSA or GCHQ dont have enough coverage as of a few years ago. But entry/exit correlation is entirely feasible.
Feb
15
reviewed Approve Securing my API: concept of access tokens
Feb
15
reviewed Approve How secure is JavaScript based OAuth 2.0
Feb
15
awarded  Custodian
Feb
15
reviewed Approve Secure tunnel set up in an office environment
Feb
15
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
Replay attacks can reuse previously valid messages, like the "Attack at Dawn" message that the evil villain resends to the recipient three days later. The message has metadata to ensure that the correct part of the OTP is used for decryption.
Feb
13
answered Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
Feb
13
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
No the problem is Key Management, as the key materiel could be compromised or lost, or an attacker could 'de-synchronise' the 2 parties (DOS).
Feb
8
comment How do I know if root account has been compromised?
Or you could scan the hard drive when mounted on a known good computer with appropriate protection against getting the good computer hacked.
Feb
8
comment How do I know if root account has been compromised?
One additional note: You can use an external scanner off a CD or DVD, which you can trust to some extent (except against the canonical Three Letter Agency). Microsoft has a bootable scanner, and you can use the linux boot dvd's to look for 'known' rootkits (I dont know of specific linux software to do this).
Feb
4
awarded  Custodian
Feb
4
revised LDAP vs MySQL for Usernames and Passwords
more detail, better wording.
Feb
3
comment How does Tor guarantee anonymity of Tor network?
Of course @KnightOfNi if the communication consists of more than just a single session or packet then the chances go up. Probably to the extent that anonymity from the NSA et al is impossible. Traffic analysis is the killer here and with enough data it becomes trivial to de-anonomise any user of TOR. There is a paper that looks at this.
Dec
9
comment Integrity-Based Execution
I love your "User Hate" comment, which applies to the entire security domain and is almost never mentioned in public, and almost never recognized in security practices at corporates.
Nov
14
awarded  Nice Question
Sep
9
awarded  Necromancer