Scott Chamberlain

678 reputation

310

bio	website
	location	Oshkosh, WI
	age	28
visits	member for	2 years
	seen	May 15 at 21:14
stats	profile views	26

Software developer.

	678 reputation	bio	website		visits	member for	2 years
310 badges		location	Oshkosh, WI		seen	May 15 at 21:14

summary answers questions tags badges favorites bounties reputation activity

30 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 29	comment	CTRL+ALT+DEL Login - Rationale behind it? @D3C4FF Just because you can't intercept the message does not mean you can't tell windows what to do when it receives the message. The important phrase from Thomas' post is "without needing administrative rights"
Mar 20	comment	Why do APIs use API Keys instead of Usernames? @SinanTaifour to use a real world example, your bank account number is a API Key, the information does not need to be kept secret, in-fact it is written on every check you hand out, however you don't go posting your bank account number on every billboard you find. Your PIN to use to call in and do phone banking would be your API Secret, you never reveal that to anyone.
Jan 28	comment	Are services like “LastPass” less secure, as they have all my passwords protected by a single password? Fair enough, good reason too.
Jan 28	comment	Are services like “LastPass” less secure, as they have all my passwords protected by a single password? You can get a offline copy of your database and a javascript app that can decrypt the database. Also the encryption is all done client side so the server is only storing binary blobs without access to the symmetric key. (that's why their "forgot your password" page does not give you a new password (it can't!), it just tells you your password hint you recorded at signup)
Jan 8	comment	how to become a untraceable hacker Hi welcom to IT Security, currently as is your question is likely to be closed per the FAQ "You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page." Please review the FAQ and see if you can edit your question to be more on topic.
Jan 4	comment	Does Authenticode still work offline and with a “fake” certificate If you forgo the time-stamp Autenticode will still work. However your end users will get a invalid signature error after the expiration date on the certificate. This is to prevent somone from stealing a old expired certificate from you, temporarily rolling back the clock on their computer, and signing a malicious exe with your old expired certificate.
Jan 4	comment	Does Authenticode still work offline and with a “fake” certificate Actually there is a online component but it is not required. If you want the authenticode signature to not give expiration warnings when the expiration date passes you must use a time-stamp server where the sigiture on the timestamp must also be signed by a trusted root (for simplicity most public CA's provide a time-stamp server and you can just have the same CA for your cert and the cert's time-stamp). See the Trusted Timestamping article on Wikipedia for more info.
Dec 13	comment	Are there guidelines for application design of HIPAA compliant browser applications? Ask a lawyer who is similar with HIPAA.
Dec 13	comment	Is it possible to decrypt symmetric key encryption without the key? Yes, without more information about *how* it was encrypted the fact of it being a key smaller than 64 bits is relatively useless.
Dec 12	comment	Is it possible to decrypt symmetric key encryption without the key? How do you know the key is "shorter than 64 bits" keys are normally a fixed size, are you referring to a pass phrase that is somewhere between 8 and 64 bits long that is turned in to a key?
Dec 12	comment	Is there an asymmetric encryption algorithm that maintains the length of the plaintext? Is there a reason for the asymmetric requirement? can you use a symmetric stream cipher and store the key asymmetrically in another location?
Dec 5	comment	Given a large enough sampling of public keys could one begin to identify a private key? That is incorrect, if you can find a cert that uses RSA for it's PKI and they share either `P` or `Q` you can trivially do the math and find the missing component by factoring the numbers together. However this is only a problem if you did not have enough entropy while generating `P` and `Q`. See this Blog post for more info
Nov 26	comment	Is Google spying on all of us? @tekiegreg you can, here is the link to it. In fact there is a OptOut tab on that page that lets you disable it entirely.
Oct 31	comment	How to login and encrypt data with the same password/key @sudopeople A static salt can be used in conjunction with a dynamic salt, but it is known as Pepper
Oct 18	comment	A String that if encrypted or decrypted with the same key gets an English word/statement in both cases One last change to not clutter the console, saves output to a sorted txt file.
Oct 18	comment	A String that if encrypted or decrypted with the same key gets an English word/statement in both cases Actually I have a updated version. I updated my code. Call `vigenere.JibberishKeys();` to get what you want.
Oct 8	comment	How does a code signing vender charge for creating certificate chains? It does not need to be Verisign, there are cheaper providers out there that may be available.
Oct 3	comment	is it possible to create a login “key” out of a USB drive? Yes it could check that, but then all the atacker needs to do is get the same model USB drive as you. I am 90% sure USB flash drives do not include a serial number on them, and if they do, it is possible (I don't know how likely) that a clone with `dd` may copy the serial number too.
Sep 15	comment	Security Review - password_hash implementation for PHP @ircmaxell Most GUIDS and UUID's do not have very much entropy in them, a lot of the source bit-fields are fixed based on the machine that generated them and sequential a time stamps. See section 4.1 of the RFC for UUID
Aug 6	comment	What kind of certificate do I need to be able to sign my own subdomain certificates? You are correct, you would deploy .example.com on all of the servers (when you import it to the certificate store make sure that the private key is not* exportable so if the server is compromised the cert is safe) then on each server you can associate the full name with the website. (if you can not set the name in IIS the friendly name of the cert must start with a * or it greys out the box, also common bug, if you get a error about it requiring the cert to be marked as exportable you loaded in to the wrong store. Load it to the machine store, not the user store.)