253 reputation
28
bio website
location United States
age
visits member for 3 years, 4 months
seen 2 days ago

Mar
28
answered How do big companies and wealthy people secure their information? And how can I secure mine?
Jan
28
comment Keeping TrueCrypt keyfiles in plain sight
No, Truecrypt allows any kind of file as a keyfile; it can be a jpeg or mp3 for example. There is no particular "profile" for a keyfile.
Dec
22
awarded  Critic
Dec
22
comment Can the xor of two RNG outputs ever be less secure than one of them?
Although two RNGs may both "run on the same hardware at the same time" that doesn't necessarily mean "they see the same events" and so set up correlated internal state. The entropy sources for the the RNGs may be entirely separate, as with a hardware RNG and a software entropy collection pool driving a PRNG.
Nov
12
comment How is “security word” safe from man in the middle attack?
Ankur, it protects againts spoofing only if the user notices the absence of the correct security word before providing his password or other important info.
Aug
19
awarded  Yearling
Jul
3
comment Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
@Eloff: The point is, if you're doing a good job of protecting one user account independent of activity over time or other accounts, then you're doing a good job for all accounts through that mechanism. If your users set feeble passwords like "password", then gentle or brute force will be able to break them. The password is generally the user's responsibility, but if you want to force them to secure their account better, you need to prohibit the most common passwords (whether or not your server even tries to thwart brute forcing).
Mar
4
awarded  Editor
Mar
4
revised No where to run, no where to hide - suggestions to improve personal security needed
fix unreadable quoting
Mar
4
suggested suggested edit on No where to run, no where to hide - suggestions to improve personal security needed
Dec
23
answered Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength?
Nov
24
awarded  Citizen Patrol
Nov
22
awarded  Teacher
Nov
22
answered Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Aug
20
awarded  Constituent
Aug
20
awarded  Caucus
Apr
25
comment Suddenly scans for 'formvars.php'
My log shows 3 sets of hits today from 3 IPs with same profile including same user agent.
Dec
26
comment Public wifi security protocols
+1: Very clear presentation of essential points; helps guide through the sea of acronyms.
Aug
23
awarded  Nice Question
May
11
awarded  Supporter