208 reputation
17
bio website
location
age
visits member for 1 year, 4 months
seen Feb 11 at 9:59

Apr
5
awarded  Yearling
Oct
15
comment Ensure data doesn't linger after being deleted
@Gilles IMHO the question is rather blurry regarding what exactly needs to be done. The "encrypt then throw away the key" approach is quite generic and has to be adapted to a particular problem. The solution for user home I have offered is just an example - and the need for it is actually implicitly contained in the question.
Oct
13
revised Ensure data doesn't linger after being deleted
added 743 characters in body
Oct
13
awarded  Editor
Oct
13
revised Ensure data doesn't linger after being deleted
added 743 characters in body
Oct
13
awarded  Critic
Oct
13
answered Ensure data doesn't linger after being deleted
Oct
13
awarded  Commentator
Oct
12
comment Ensure data doesn't linger after being deleted
@NickODell before trying to reopen, some things are still a bit unclear to me: what confidential data in your setup is not in RAM, having /home, /tmp and /var mounted there. Usually there's not much more, apart from the system itself. Are you using SSD or old-fashioned spinning plate HDD?
Oct
12
comment Ensure data doesn't linger after being deleted
What exactly are you asking about? Most of your text are just statements.
Oct
1
comment How can I prove that I wrote a certain blog post?
It actually doesn't prove you wrote it, rather it says something about your approval of that post (provided the private key isn't stolen, of cource :)).
Jun
10
answered Login system using authenticated encryption without storing user password
Jun
10
comment Login system using authenticated encryption without storing user password
The server actually knows K: when the user tries to log in, he/she sends the password and the server hashes it to obtain the required key. The point is, that neither the key nor the hash are kept for longer than absolutely necessary to decrypt the file.
Apr
15
comment What are the ways to implement two factor authentication?
OpenSSH now supports multiple authentication methods (you can require several of them) - see openssh.org/txt/release-6.2.
Apr
5
comment Why are UNIX-like ACLs not a form of MAC
Thanks for the discussion - do you have any preferred resources that discuss this?
Apr
5
comment Why are UNIX-like ACLs not a form of MAC
OK I see the point, then the definitions you have used in the answer seem to be too vague - the triple (subject = code running with privileges of a particular user, object = file, action = open object) satisfies the definitions. Basically it revolves around the precise border between subject and action. Or is it that I have wrong lexical context (i.e. the system one instead of the security one)?
Apr
5
comment Why are UNIX-like ACLs not a form of MAC
I have to admit I don't really understand your answer - any process (read "code") running on a UNIX system has some defined rights. Yet these are set by the administrator and enforced by the kernel (at least in theory) - the user has nothing to do with it and in most cases can do nothing to change it. The exception is elevating one's privileges through su and similar, but these are again system wide policies. The answer would make sense to me if one changed inherit/assume the permissions to change the permissions to the object though. Would that make sense?
Apr
5
awarded  Scholar
Apr
5
awarded  Student
Apr
5
accepted Why are UNIX-like ACLs not a form of MAC