19,870 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 3 months
seen 2 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Sep
6
awarded  Civic Duty
Sep
5
comment Effectiveness of Security Images
@curiousguy - While those types of phishing attacks are frequent, many bank users have been trained to type in the URL themselves, be suspicious of emails, or use a bookmark and are still vulnerable to phishing by attacks on routing (ARP spoof) or DNS resolution, both off the radar for most users in which case HSTS is a life-saving feature (note HSTS doesn't allow user to click through warnings). Other than education, there's not much you can do to prevent someone falling for a phishing scam that runs on a totally different server; possibly even with a CA-trusted SSL cert.
Sep
5
comment Effectiveness of Security Images
@curiousguy - Yes. But if an attacker has redirected mybank.com to a malicious IP instead of the banks IP, and the user has visited the bank in the past ~90 days or HSTS is hard coded in the browser then this prevents that simple attack. Sure the attacker could still trick someone into clicking/typing to go to my-bank.com a completely different site which doesn't use SSL. Again, not idiot-proof but you may notice. (Or a proactive bank could purchase and enable HSTS for similar domain names).
Sep
5
comment Effectiveness of Security Images
+1 - Good answer. I don't think our answers are mutually exclusive. The results of the study are probably somewhat dated (~5 years) as modern browsers make https more prominent (green URLs/Trust bars) as well as HSTS. I think if repeated, more users would notice the lack of HTTPS/SSL. You still recommend SSL for passwords & banking, correct? Possibly in this environment more users would avoid the 'security image feature is down'; if it was easier to notice hey the page also lacks https at that moment. Again phishers will find and fool clueless users, though hopefully not me.
Aug
31
comment How can one defend against DoS attacks at the physical layer?
Several cool-looking android tablets support wired ethernet, typically with an add on rj45 to USB connector e.g., transformer prime -- however this is at the cost of mobility one of the major benefits of tablets. Apple seems to have no interest in allowing networking through their dock connector.
Aug
30
answered Remove Password Protection from XLS Document
Aug
30
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
If you've never setup a secure firewalled DICOM/HL7 listener over SSL/VPN between remote entities where tech support level is different using different products/lingo its not a straightforward. (Connector Type (LLP? TCP? Web Service Listener?) Receive timeout? Buffer Size? Frame Encoding? Strict Validation? Encoding? Send ACKs? Transactional Endpoints?). And that's not even getting into adding firewall rules for remote clinics and general debugging.
Aug
30
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
@Oleski - I agree that's the solution for frequent interactions, but its unrealistic for requests to transfer medical records to every small clinic which may have no IT staff (and may not even have EMR or digital PACS). The receptionist at the two clinics will be doing this work, and they can't delay days until the other clinic gets back to them with the IP/port/certificate/etc other configuration and is on the phone debugging the connection.
Aug
30
comment Google Account: implications of using application-specific passwords
@RohanDurve-Decode141 - I still don't see where the 24 comes from -- there are twenty-six English letters. I just enabled 2-factor on a test google account and generated a several passwords and saw all 26 letters at least once.
Aug
30
awarded  Nice Answer
Aug
30
comment Google Account: implications of using application-specific passwords
Where'd the 16^24 came from -- its 26^16? E.g., 26 lower case letters; so an 1-char pw has 26^1 possibilities; two char has 26^2, 16-char has 26^16 = 4 x 10^22.
Aug
30
comment How strong are google's Application-specific passwords?
@curiousguy - I know. 4x10^22 is a huge number and infeasible for online attacks. If google lets you try indefinitely and somehow you went through a billion tries per second, it would still take a about a million years before you are likely to get it. Google would like blacklist your IPs after a couple thousand bad attempts (thinking you attempting to DoS them). Even for offline hashing at a rate of billions passwords tried per second; the electricity costs alone would be prohibitively expensive to crack it (see last line in table).
Aug
30
revised What's the practical limit for rainbow-table based bruteforce?
Added table
Aug
29
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
@Oleski - Also just because you are using DICOM does NOT ensure that the data is either stored or transferred encrypted. It just ensures that the relevant metadata is kept with the image and that it was transferred in a reliable way. (I had to double check that encryption is not a mandatory part of the DICOM push standard). See page 7 of Part 15 of DICOM standard where they clarify "The DICOM standard does not address issues of security policies, ... [it] only provides mechanisms that could be used to implement security policies ... "
Aug
29
revised what would be a good way for a doctor to send xrays encrypted to another doctor?
added 390 characters in body
Aug
29
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
@Oleski - I am quite familiar with DICOM and HL7 standards. First, HL7 only deals with the format of the messages (at the application level) and doesn't deal with encryption (typically done at the lower OSI layer via an SSL socket or IPSec). But setting up a business connection to connect PACS to do DICOM push from different hospitals takes weeks to months of business agreements, meetings between IT teams to setup VPN/configure access rights/setup certificates, etc. It is impractical to require each practice to manage their own DICOM server to receive images for one patient moving.
Aug
29
comment making an iPhone/Android app which sends a user password to my server, how to secure?
@D.W. - Yes the hash becomes the effective password, but at the very least the pre-hash password is not given as plaintext (though again; a simple cryptographic hash like sha256 is usually easy to brute force via GPU. Also local timestamp issues could be resolved if the timestamp nonce is server-generated (possibly with JS to keep up to date) when the page loaded and checked. But still this is rolling your own, vulnerable to several problems. In this case MitM where the fake site bypasses this scheme and asks/ records users' pw directly.
Aug
29
comment making an iPhone/Android app which sends a user password to my server, how to secure?
@fiftyeight - There's no real disadvantage for free cert except it is only class-1 (tied to an individual who owns the domain not an organization) and lacks some fancy features (e.g., wildcard domains) or self-signed (except self-signed you'll have to verify the fingerprint yourself and roll an update if the certificate expires/changes and can't reuse the certificate for browser-based traffic to your site).
Aug
29
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
@CodesInChaos - this can be done on a relatively straightforward web application (not sure what you mean by 'plain') as demonstrated in my answer. I wouldn't design a system myself without several security audits, HIPAA experts reviewing, though.
Aug
29
answered what would be a good way for a doctor to send xrays encrypted to another doctor?