2,511 reputation
1017
bio website
location
age
visits member for 4 years
seen yesterday

Jun
23
comment Why can't reverse engineering be automated?
@raz: yes, your answer is perfectly fine for the question; my comment was going on the tangent about the reverse engineer aspect that you brought up. ... the heuristic engine still doesn't understand exactly what the malware does. Only that it's actions are statistically malware. on which I argue is exactly what a human reverse engineer would be doing. Even a moderately experienced reverse engineer is still a lot better in this task than the most sophisticated heuristic engines though, but the methods aren't really that different.
Jun
23
comment Decrypting TOR traffic?
@raz: Tor doesn't guarantee anonymity either, if you send personally identifiable data over the Tor connection without an additional end-to-end encryption, the Tor exit node can trivially obtain ny unencrypted data you send over the exit node. The only thing that Tor guarantee is that Tor itself does not leak anonymity; your traffic may leak your anonymity.
Jun
23
comment Why can't reverse engineering be automated?
If you are really talking about "reverse engineering", not just "decompilation", then the problem is that you are fighting against the Halting Problem. Nevertheless, this doesn't stop antivirus and IDS/IPS writers from creating a heuristic analysis engine which is essentially an automatic reverse engineering system.
Jun
21
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: if you are doing encryption on the client side, you must protect the client against compromise/virus/etc. If you do the encryption on the server side, you must protect both the client and the server against compromise/virus/etc. The latter just have more attack surfaces. If the client is compromised, you must consider the data coming from them as compromised, especially if the data is not encrypted by the client. Encrypting the data on client side, does not make client compromise any worse.
Jun
21
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: the problem is that your first requirement states "... the users to know that even the staff cannot access their data". Doing encryption on server side means this requirement is impossible, it's no longer just a matter of trust. You might as well just use no encryption or a single encryption key for all users (e.g. full disk encryption), they're much simpler to implement and more importantly the security isn't any different.
Jun
18
comment Which strategy to encrypt data accessed by multiple users?
@BenjaminSinclaire: if you are encrypting on the server, then it is broken by design because your server will have the data in plain text at some point. Any malicious tech staff/attacker can just grab the data before it gets encrypted. As to your second point, if the client is insecure, then the user are already screwed whether you do the encryption on client side or server side. The risk of leaks are much higher if you do not encrypt end to end.
Jun
17
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: a security conscious user should not trust the server's claim that an encryption key belongs to another user. This is similar to how PGP's Web of Trust works does not depend on PGP keyservers. Like PGP, the security conscious user should verify other users's user-key out of band, so the client must have mechanism to view and compare user-key. Although the concept described here would work with any strong asymmetric encryption algorithm, I'd recommend actually using GPG to implement the asymmetric encryption here; it's a mature implementation and widely understood.
Jun
17
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: for best security, the client has to be open sourced and has deterministic build. A security conscious user can audit the source code and compile the client themselves. With the user being able to trust the client, the user does not need to trust the server operator at all, because no sensitive information is ever sent to the server and the server cannot forge malicious data. The most damage the server operator can do, is delete data.
Jun
17
comment SSL is Extended Validation more secure?
To summarize, domain validation is all about tying the connection with the domain name, while extended validation is about tying the connection with not just the domain name but also a physical business. The big flaw with EV certificate though, it relies on the user to care and enforce it.
Jun
17
comment SSL is Extended Validation more secure?
@mcgyver5: you're probably seeing certificate pinning in action
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
deleted 4 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 1 character in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
answered Which strategy to encrypt data accessed by multiple users?
Jun
17
comment Saving username and pasword inside SQL
@S.L.Barth: even when taking into account the LastPass debacle, they are still much more secure than the home brew password managers the OP is proposing (LastPass encrypts the password client-side, so the impact of the breach seems to be fairly minimal). If you really need to take your password managers with you, properly implemented cloud-based managers can be a convenient trade off.
Jun
17
comment Saving username and pasword inside SQL
@Shawn: security by obscurity is not a good bet to make. Take care that a lot of people uses weak passwords and reuses their passwords on multiple sites. Leakages from your low security application might end up with more serious breaches if the user has been reusing passwords they store in your home brew password manager with their other important accounts. Mature password manager programs comes with browser plugins and integration plugins for things like autofilling and strong password generator, which are security and usability pluses as well.