38,999 reputation
966136
bio website tltech.com
location United States
age 35
visits member for 3 years, 7 months
seen 23 mins ago

{{Hacker}}

I own a small, successful security consulting business. But by day I work for a really big company, doing really big things.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidental knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


3h
answered Can a lock picker slowly undermine the security of a deadbolt door?
2d
awarded  Announcer
Nov
19
awarded  Notable Question
Nov
16
comment How secure are the FIDO U2F tokens
@user10008, eh. ok. That's not really a credible scenario, though. Certainly not one that warrants special design considerations and a 10x increase in hardware costs. The smart user would not knowingly use a compromised workstation at all, and a sensible security posture would disallow it completely, not try to accommodate it safely.
Nov
16
comment How secure are the FIDO U2F tokens
@user10008 there is, by definition, no way to protect against a compromised user agent. Even if you can protect the login step, a man-in-browser attack can simply wait silently until authentication has completed successfully and then insert its malicious traffic using the properly authenticated session. This is outside the scope of any authentication system as the authentication needn't be compromised. A screen in the device can't offer meaningful perfection here.
Nov
16
awarded  Nice Answer
Nov
16
revised How secure are the FIDO U2F tokens
added 876 characters in body
Nov
15
comment Is using Git for deploying a bad practice?
Is this really a security question?
Nov
5
awarded  Announcer
Nov
1
answered How to report vulnerabilities without being regarded as a hacker?
Oct
30
revised How secure are the FIDO U2F tokens
added 227 characters in body
Oct
28
awarded  Popular Question
Oct
28
answered Encrypted container on top of a copy-on-write filesystem
Oct
27
answered How secure are the FIDO U2F tokens
Oct
26
awarded  Nice Answer
Oct
24
awarded  Nice Question
Oct
24
awarded  Popular Question
Oct
22
comment One liner to create passwords in linux?
Sample password produced by the last item: cold-hammered brazen-face self-displicency Bajocian transcends grewsome harpoon pedanticness. Probably easier to remember if you draw a cartoon for it.
Oct
22
asked How secure are the FIDO U2F tokens
Oct
16
awarded  Great Question