387 reputation
18
bio website
location
age
visits member for 2 years, 10 months
seen Apr 12 at 20:46

Jan
12
awarded  Citizen Patrol
Jan
9
comment Is a rand from /dev/urandom secure for a login key?
What it means when /dev/urandom runs out of entropy is that it produces a more predictable randomness, by that it means that an attacker with enough processing power can theoretically do statistical analysis of your random numbers to determine the internal state of the PRNG, and therefore predict your future random output. This is easier said than done though.
Dec
28
comment How secure is “Secure Keyboard Entry” in Mac OS X's Terminal?
FYI, apple.stackexchange.com/questions/70609/…
Oct
20
comment Isn't all security “through obscurity”?
One aspect of separating secrecy of algorithm from secrecy of the key is that you don't have to kill those who designed your security system to keep your secret a secret.
Oct
14
revised Do we need to logout of webapps?
added 63 characters in body
Oct
14
answered Do we need to logout of webapps?
Oct
6
comment Can a steel woven wallet prevent RFID scanning of credit card information?
I don't really see the point of shielding the inside of the wallet itself. One of the great advantage of RFID card is the convenience of being able to use it without fishing the card out from the wallet. If you had to pull the card out of the wallet to use it then wouldn't it be easier and safer to just get a swipe-only card? Also, even with inner shield, in the end you still have to unshield the card to use it, exposing it to remote readers anyway.
Sep
28
comment Password-less network in skyscraper office
@thatguyfromoverthere: POP, IMAP, SMTP, VoIP services (UDP), NTP, and IM services are common protocols that almost everybody has on their phone and can connect without the guest ever touching his device. A captive portal can break the guest's mobile internet connection and those services if the device were ever connected to the network and the guest didn't remove the wireless network from remembered wireless networks list.
Aug
8
comment I found obfuscated code in a comment on my blog. What should I do?
@Green Fly: Note that, depending on how exactly the html is escaped, and whether the unescape or the automatic escaping mechanism that is available in certain web frameworks is properly used, it may still be possible that the unescaped comment get accidentally rendered, usually in less used area of the website that aren't as carefully scrutinized. It may still be a good idea to remove such attempted attack from the database (after scrutinizing the admin page that you used to delete the comment, of course). I may be a little paranoid.
Jul
23
revised Sending HTTP 403 as. 200 - “Silent Identification of Admin”
added 24 characters in body
Jul
23
answered Sending HTTP 403 as. 200 - “Silent Identification of Admin”
Jun
25
awarded  Nice Answer
Jun
24
awarded  Yearling
Jun
24
answered What are the purposes of these security policies?
Jun
8
comment What are the implications of NSA surveillance on the average internet user?
is there any possible security issue with using end-to-end encryption over operator's network? I'd be hardpressed to believe that anonymous adhoc Wifi mesh nodes are more trustworthy than operators.
Mar
29
comment SSH password vs. key authentication
Private key files can also be invalidated and reset in centralized manner.
Mar
6
comment At what point does something count as 'security through obscurity'?
In very high security situation, point 2 is not strictly speaking true, there are situations where nobody knows the whole secret, each person only knowing parts of the secret, and they all had to be present to unlock the secret.
Feb
5
comment Firefox pre-downloading
@Aerus: that is a different kind of link prefetching.
Feb
2
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
@curiousguy: I agree though that compromising the computer is a more likely event than compromising the token. However with challenge-response and second device receipt, it would be extremely difficult to forge transactions, and nearly impossible to do so without being immediately noticed, even when using a compromised computer.
Feb
2
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
@curiousguy: security token is usually offline, so compromising them requires physical possession of the token, and just like PKI systems, it doesn't really matter if an attacker figured out how the device works, because what matters is the secret private key which cannot be easily extracted from the device even with physical possession of the token.