Reputation
1,528
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 18
Newest
 Good Answer
Impact
~38k people reached

Jan
27
comment How can changing your DNS protect your online privacy?
Hogwash. DNS requests are plaintext and UDP. If your ISP is acting in bad faith they can intercept DNS requests going to a different resolver just as easily as requests going to their own.
Jan
26
comment How can changing your DNS protect your online privacy?
The only way this could work is if they have a http proxy as well as a dns server -- and even then it wouldn't stop your ISP from seeing what you're doing. This is almost certainly a con.
Jan
9
comment How to know whether a textfile has been edited or tampered with?
@philipp is correct - at best, this is "security by obscurity" and it's no protection at all against anyone with rudimentary knowledge, a hex editor and a modicum of patience.
Nov
20
comment How does the hacker manage to spoof a different IP address?
Doesn't need to be their own router -- theoretically, any router in between the target's computer and the address segment they're trying to spoof would suffice.
Nov
20
revised Can I use port 443 without SSL?
No SSL == No encryption. That statement made zero sense.
Nov
20
suggested approved edit on Can I use port 443 without SSL?
Oct
28
comment HSTS on sites available over HTTP and HTTPS
A user with broken HTTPS should probably install a browser with working HTTPS instead... But maybe that's just me being unreasonable.
Oct
15
answered How can one execute code upon entry of folder in Windows?
Oct
9
awarded  Good Answer
Oct
2
comment How do DoS attacks work on non-servers?
The computer in question still has to process the traffic, even if it's only to say "nothing listening in this port, sorry".
Sep
21
comment Should I password protect all my archives from cloud?
@CommuSoft "It's not that I don't trust you; it's that I don't trust anyone."
Aug
25
comment Is a server infrastructure fundamentally possible which the smartest person can't breach?
@jonathantodd In fact, your original comment makes the 0days worse because now you have no way of getting to the computer to fix them after they're discovered.
Aug
25
comment Is a server infrastructure fundamentally possible which the smartest person can't breach?
@JonathanTodd Let me save you a great deal of effort then: The answer is "No." As long as there will be humans who should be able to access the data, there'll be a loophole to exploit for humans who shouldn't.
Jun
30
comment How secure is Snowden's MargaretThatcheris110%SEXY password?
It may be a known algorithm now, but the key space of "a relatively short English sentence that may or may not make sense" is one hell of a large key space to attempt to bruteforce. PGP/GPG isn't any less secure just because people know how it's calculated.
Jun
20
comment UEFI and security implications for encryption
"Trust issues" pretty aptly sums up my objection to UEFI as a concept -- as in, I don't trust either the hardware manufacturers or Microsoft who's insisting on it.
Jun
1
comment How to detect self destructing emails? How to prevent from self destruction?
@dr01 It only works if the client reading the "protected" mail goes along with it. Needless to say, most of them don't.
May
22
comment Are duplicate SSH server host keys a problem?
It's also a good idea on cluster hosts, because if you don't every single ssh implementation I'm aware of will throw a fit if you try to connect to the shared IP when a different host has the master flag set...
May
22
comment Is there a backdoor in the hardware of our smartphones?
Out of curiosity, why would you think the Android is less 'safe' in this regard than the iPhone?
May
22
comment MySQL/CGI: password in C source file unsafe?
@pacerier Through any number of potential security vulnerabilities in poorly written website code, or even unpatched vulnerabilities in the daemon itself. Check on the usual security sites for "remote execution exploits" or similar keywords. I just had to yell at a customer over a breakin like that the other day.
May
20
comment Web Developer's responsibility for DDoS
Not a legal liability per se, more a professional obligation. Like I said, most of those were basically sound programming practice... although legally someone might decide to argye it's due diligence. IANAL though so don't take this as read.