43,157 reputation
1072142
bio website tltech.com
location United States
age 36
visits member for 3 years, 11 months
seen 1 hour ago

{{Hacker}}

Long-time owner and operator of a small, successful security consulting business. As of recently, though, by day I work for a really big company.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidential knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


Mar
13
comment Does Android have sufficient app sandboxing?
@paj28 theoretically, yes. But rooting a phone installs a sandbox escape. Ideally you adequately protect that escape, and ideally no apps that use root access create additional vulnerabilities (many cases of this happening), and ideally the initial root vulnerability actually gets patched. Ideally, but not always in practice.
Mar
13
revised Does Android have sufficient app sandboxing?
added 1 character in body
Mar
9
comment Why deploy a .p12 client certificate bundled with a root CA?
I mean it's a default choice and no intent should be read in to it.
Mar
8
answered Why deploy a .p12 client certificate bundled with a root CA?
Mar
8
comment Does Android have sufficient app sandboxing?
@RockPaperLizard "usually works" is not a high enough bar for the developer of an operating system. A feature the even had the potential of introducing crashes is a buggy feature, and can't be released. If the permissions model is Android's greatest failing, then they're doing extremely well. This is a problem that hasn't been adequately solved by anyone; Apple's solution is reasonable but still insufficiently granular to offer meaningful protection, and no other mainstream OS even sees this this as a problem to solve.
Mar
8
answered Does Android have sufficient app sandboxing?
Mar
8
answered Is ENCFS secure for encrypting Dropbox?
Feb
27
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
@Hogan sqrl exists for the sole purpose of protecting user identity. It has literally one job. The purpose of HTML is not for protecting user identity. We won't fault HTML for not doing a job it doesn't have.
Feb
27
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
@Hogan that's the domain that generated the qr code, not necessarily the one that displays the qr code. It matters when the two are not the same, and sqrl is specifically designed in a way that cannot tell the difference, and thus cannot protect the user from phishing. This is a primary reason why the community at large is ignoring it.
Feb
25
awarded  Nice Answer
Feb
25
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
@Hogan Yep. Just like how phishing never works because the user can verify the domain name on a fake login page. Trusting the use to manually verify that the URL is correct: how could that possibly go wrong?
Feb
25
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
@Hogan Eve visits GRC.com and gets the qr code to log in. Eve displays that qr code to you via phishing page. You scan the qr code and authenticate on your phone. Eve is now logged in as you. The problem is that the qr code doesn't mean anything to the browser the way a form action or URL does, so sqrl can't enlist the browser's help in verifying the site's validity to fight phishing.
Feb
24
comment How does DNSSec work? Are there known limitations or issues?
@Ajedi32 records signatures can be traced to the root. Since the root servers ARE signed, and since everyone knows that they are, then you'd either have to convince the client that suddenly they are not, or forge a signature to say that something along the chain isn't.
Feb
23
awarded  Great Answer
Feb
19
comment Is “password knocking” a good idea?
@IsmaelMiguel in other words, long passwords take longer to guess.
Feb
19
comment Is “password knocking” a good idea?
@IsmaelMiguel No, the attacker will just try ["A","A","A"], ["A","A","B"], etc., until he gets to ["A","B","C"]. He doesn't have to try every combination on the first field before moving on to the second. If I told you my password had three spaces in it, you wouldn't be paralyzed trying to figure out what came before the first space. You'd just try the shortest possibilities first.
Feb
19
comment Is “password knocking” a good idea?
@kutschkem that is exactly correct.
Feb
19
awarded  Good Answer
Feb
19
awarded  Nice Answer
Feb
19
answered Is “password knocking” a good idea?