39,834 reputation
969137
bio website tltech.com
location United States
age 35
visits member for 3 years, 7 months
seen 4 hours ago

{{Hacker}}

I own a small, successful security consulting business. But by day I work for a really big company, doing really big things.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidental knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


16h
awarded  Good Question
20h
answered 2-factor authentication - Who am I trusting?
20h
accepted How secure are the FIDO U2F tokens
1d
awarded  tls
Dec
15
comment Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?
An attacker trying to compromise your computer at Starbucks doesn't need to be closer than the other side of the store.
Dec
14
answered How to call webservice securely in Android
Nov
30
awarded  Guru
Nov
28
awarded  Good Answer
Nov
28
comment Can a lock picker slowly undermine the security of a deadbolt door?
@CarlWitthoft can you really not come up with any ideas?
Nov
28
comment Can a lock picker slowly undermine the security of a deadbolt door?
@Village while the technique I learned used soot to enhance the markings made by the pins, watching the videos you can see that today this is done using a normal clean key, with magnification to see the scratches in the metal. So no sign of tampering needs to be present.
Nov
26
revised Can a lock picker slowly undermine the security of a deadbolt door?
deleted 13 characters in body
Nov
26
revised Can a lock picker slowly undermine the security of a deadbolt door?
deleted 32 characters in body
Nov
26
awarded  Nice Answer
Nov
26
answered Can a lock picker slowly undermine the security of a deadbolt door?
Nov
23
awarded  Announcer
Nov
19
awarded  Notable Question
Nov
16
comment How secure are the FIDO U2F tokens
@user10008, eh. ok. That's not really a credible scenario, though. Certainly not one that warrants special design considerations and a 10x increase in hardware costs. The smart user would not knowingly use a compromised workstation at all, and a sensible security posture would disallow it completely, not try to accommodate it safely.
Nov
16
comment How secure are the FIDO U2F tokens
@user10008 there is, by definition, no way to protect against a compromised user agent. Even if you can protect the login step, a man-in-browser attack can simply wait silently until authentication has completed successfully and then insert its malicious traffic using the properly authenticated session. This is outside the scope of any authentication system as the authentication needn't be compromised. A screen in the device can't offer meaningful perfection here.
Nov
16
awarded  Nice Answer
Nov
16
revised How secure are the FIDO U2F tokens
added 876 characters in body