890 reputation
610
bio website
location
age
visits member for 3 years, 2 months
seen 12 hours ago

21h
comment Is a password in the clipboard vulnerable to attacks?
Keyloggers usually would require admin privilege, but you don't usually need any special privileges to read the clipboard.
21h
comment How to protect source code locally when traveling with it
Who are you worried about will steal your source code? Are you worried about a random thief? the transport security agents/hostile government? A corporate spy from competitors? Do you store production database passwords, encryption keys, or other such sensitive materials with the source code? What's your threat model?
Aug
17
comment Where can I find a list of frowned upon usernames for web sites?
Given that it's fairly easy to forge email From address, you always need to be careful when receiving emails from unknown senders, whether or not it has official titles in name that they introduced themselves as. You need to identify admins by special symbols or statuses, for example on stack exchange community moderators are given the diamond symbol. Then you only need to prohibit the diamonds symbol from being used by regular username and teach your users how to identify admins correctly rather than relying on name itself.
Aug
13
comment Can we trust antivirus software?
If this is a concern for you, an avenue is to find an open source antivirus software. Since the source code is open, you can inspect the code and assure yourself it doesn't hide any backdoors. As of now, the most popular open source antivirus software is those by clamav.
Aug
8
comment Is there ever a good reason _not_ to use TLS/SSL?
I meant between the embedded device and the server
Aug
7
comment Is there ever a good reason _not_ to use TLS/SSL?
You can setup an ssl stripping proxy between the microcontroller and the embedded device. Although you should consider the security impact, as services that offers ssl only connection usually does so out of actual concerns that they have. If you want to offer a bit of protection still, then you can rewrap the connection between the device and your proxy server with custom encryption scheme that has smaller overhead.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@Emiliano: even your site is HTTPS only, an attacker can setup a man in the middle attack and setup a fake server that uses plain HTTP, performing what is known as SSL stripping. The browser will send to the fake server the user's cookie. To mitigate this, you need Secure cookie and HSTS policy.
Aug
1
comment Should SSL be terminated at a load balancer?
If you're on a secured colocation, then it's natural that you trust your own machine (which inside a physical cage) more than you trust the data center.
Jul
31
awarded  Guru
Jul
31
comment Proof of SIM card possession on iOS devices
A SIM card is not just a dumb memory storage, it's actually a smartcard with a CPU, RAM, ROM, and tamperproof storage area, and has an embedded OS and is capable of running applications written in a subset of Java.
Jul
31
awarded  Good Answer
Jul
30
awarded  Mortarboard
Jul
30
awarded  Yearling
Jul
30
awarded  Enlightened
Jul
30
awarded  Nice Answer
Jul
30
comment How does a SIM card prevent cloning?
@LS97: I've updated the answer with more details and further links.
Jul
30
revised How does a SIM card prevent cloning?
added 10 characters in body
Jul
30
revised How does a SIM card prevent cloning?
added 1473 characters in body
Jul
30
comment How should passwords be stored if they must be recoverable?
The security of such system is basically the weakest link. You might as well not bother with saving it in non-recoverable format and simplify your system with just the PKI-encrypted password.
Jul
30
answered How does a SIM card prevent cloning?