20,259 reputation
23393
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 4 months
seen 10 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Sep
18
revised What is the purpose of the entropy parameter for DPAPI.Protect?
added 215 characters in body
Sep
18
revised What is the purpose of the entropy parameter for DPAPI.Protect?
added 2177 characters in body
Sep
18
answered What is the purpose of the entropy parameter for DPAPI.Protect?
Sep
17
answered Securing mail deliveries in a multi-tenant office building
Sep
14
awarded  Notable Question
Sep
13
answered Is this a good way to store passwords in a Web Application?
Sep
11
comment Is Spoofing a CA signed certificate possible?
@asudhak - The public certificate is of no use. The private key is needed to decrypt traffic from the client to complete the handshake. If the attacker cannot decrypt the traffic because they use someone else's public key the TLS handshake fails and the browser gives a warning.
Sep
11
answered Is Spoofing a CA signed certificate possible?
Sep
11
comment How to check if someone is in my computer
@Thomas - no they use emacs C-x M-c M-butterfly.
Sep
10
comment Global Blackout is a myth?
Well someone brought down godaddy's DNS today causing a massive headache for anyone who didn't get around to migrating all their domains away from them. Not nearly as impressive as bringing down all root DNS servers, but someone managed to DoS a good chunk of internet traffic and inconvenience a good number of sysadmins.
Sep
10
comment Is MD5 considered insecure?
@ewanm89 - 2^123.4 is infeasible (even with billions of GPUs calculating billions of MD5 hashes per second for billions of years). Yes its better than 2^128 by a factor of 24, but the distinction is meaningless for real attacks. (But agree with other reasons to avoid MD5).
Sep
9
answered How to avoid leaving any local trace that I went to a website?
Sep
6
awarded  Civic Duty
Sep
5
comment Effectiveness of Security Images
@curiousguy - While those types of phishing attacks are frequent, many bank users have been trained to type in the URL themselves, be suspicious of emails, or use a bookmark and are still vulnerable to phishing by attacks on routing (ARP spoof) or DNS resolution, both off the radar for most users in which case HSTS is a life-saving feature (note HSTS doesn't allow user to click through warnings). Other than education, there's not much you can do to prevent someone falling for a phishing scam that runs on a totally different server; possibly even with a CA-trusted SSL cert.
Sep
5
comment Effectiveness of Security Images
@curiousguy - Yes. But if an attacker has redirected mybank.com to a malicious IP instead of the banks IP, and the user has visited the bank in the past ~90 days or HSTS is hard coded in the browser then this prevents that simple attack. Sure the attacker could still trick someone into clicking/typing to go to my-bank.com a completely different site which doesn't use SSL. Again, not idiot-proof but you may notice. (Or a proactive bank could purchase and enable HSTS for similar domain names).
Sep
5
comment Effectiveness of Security Images
+1 - Good answer. I don't think our answers are mutually exclusive. The results of the study are probably somewhat dated (~5 years) as modern browsers make https more prominent (green URLs/Trust bars) as well as HSTS. I think if repeated, more users would notice the lack of HTTPS/SSL. You still recommend SSL for passwords & banking, correct? Possibly in this environment more users would avoid the 'security image feature is down'; if it was easier to notice hey the page also lacks https at that moment. Again phishers will find and fool clueless users, though hopefully not me.
Aug
31
comment How can one defend against DoS attacks at the physical layer?
Several cool-looking android tablets support wired ethernet, typically with an add on rj45 to USB connector e.g., transformer prime -- however this is at the cost of mobility one of the major benefits of tablets. Apple seems to have no interest in allowing networking through their dock connector.
Aug
30
answered Remove Password Protection from XLS Document
Aug
30
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
If you've never setup a secure firewalled DICOM/HL7 listener over SSL/VPN between remote entities where tech support level is different using different products/lingo its not a straightforward. (Connector Type (LLP? TCP? Web Service Listener?) Receive timeout? Buffer Size? Frame Encoding? Strict Validation? Encoding? Send ACKs? Transactional Endpoints?). And that's not even getting into adding firewall rules for remote clinics and general debugging.
Aug
30
comment what would be a good way for a doctor to send xrays encrypted to another doctor?
@Oleski - I agree that's the solution for frequent interactions, but its unrealistic for requests to transfer medical records to every small clinic which may have no IT staff (and may not even have EMR or digital PACS). The receptionist at the two clinics will be doing this work, and they can't delay days until the other clinic gets back to them with the IP/port/certificate/etc other configuration and is on the phone debugging the connection.