meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 11 months |
| seen | yesterday | |
| stats | profile views | 14 |
|
Mar 29 |
comment |
SSH password vs. key authentication Private key files can also be invalidated and reset in centralized manner. |
|
Mar 6 |
comment |
At what point does something count as 'security through obscurity'? In very high security situation, point 2 is not strictly speaking true, there are situations where nobody knows the whole secret, each person only knowing parts of the secret, and they all had to be present to unlock the secret. |
|
Feb 5 |
comment |
Firefox pre-downloading @Aerus: that is a different kind of link prefetching. |
|
Feb 2 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @curiousguy: I agree though that compromising the computer is a more likely event than compromising the token. However with challenge-response and second device receipt, it would be extremely difficult to forge transactions, and nearly impossible to do so without being immediately noticed, even when using a compromised computer. |
|
Feb 2 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @curiousguy: security token is usually offline, so compromising them requires physical possession of the token, and just like PKI systems, it doesn't really matter if an attacker figured out how the device works, because what matters is the secret private key which cannot be easily extracted from the device even with physical possession of the token. |
|
Jan 30 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @curiousguy: If the device is compromised, the bank can simply issue a new device with a new seed, compared to changing PINs/password it's obvious which is more secure. And the danger of compromising an active session always exists whatever auth method you use, so what's your point? Anyways, many banks that use token authentication requires new password for every transactions, a single-use password is valid for one transaction only and is time-limited or use a challenge-response so the password is only valid for that particular transaction. Some also SMS/email you your transaction receipt. |
|
Jan 27 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? Seems like a ridiculous race. The danger of keylogging can be averted by using a one-time password generated by hardware tokens. Even if the one-time password is compromised, it would have immediately expired and be useful for nothing. |
|
Jan 17 |
comment |
Are passwords stored in memory safe? kinda related, OpenGL is not required to clear the content of the framebuffer when creating buffers, so it is possible for a malicious program to grab what another program was drawing including those in non-visible buffers: stackoverflow.com/q/4112421/309412 |
|
Dec 12 |
comment |
Password Salts and Randomness Regarding SHA256(username || email || time || mt_rand()) note that the initial seed for mt_rand() is usually time and pid, which means it adds only very little additional entropy, especially considering that username and email of users are often publicly known. |
|
Nov 24 |
answered | How valuable is secrecy of an algorithm? |
|
Nov 5 |
comment |
How do you log in from an unsecured computer? Fair enough, now I'm officially crowning you paranoid ;) |
|
Nov 5 |
comment |
How do you log in from an unsecured computer? Why not just have a hardware write-protected USB key? and a second USB key for holding data. |
|
Nov 3 |
comment |
Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers? @clayrichardson unless you know how to do it properly, combining two good crypto primitives often produces a crypto that is less secure than the original cryptos they were made of, that's why people always say never to create your own crypto. |
|
Nov 3 |
comment |
How to block or detect user setting up their own personal wifi AP in our LAN? to clarify, I'm not saying that all technical measures are worthless, but ineffective technical measures are worse than doing nothing. In many cases, these technical measures comes at a cost, and the cost is not always something that is easy to quantify. If you still think such cost is outweighed by the benefits, then it's probably for the best, but when ineffective measures does not really do much, you're better off not implementing it. |
|
Nov 3 |
comment |
How to block or detect user setting up their own personal wifi AP in our LAN? Users that feels that they are not being trusted are the ones that are the most likely to try to find a way to workaround technical barriers, instead of working together with it. |
|
Nov 3 |
awarded | Critic |
|
Nov 3 |
comment |
How to block or detect user setting up their own personal wifi AP in our LAN? Technical solution is worthless if it is not effective, as in this case, everything on here can be worked around relatively easily by ordinary users and they come at tremendous cost. For instance, locking down USB prevents legitimate user from doing legitimate work. NAC, while a good idea for many problems, adds unnecessary complication to network management. Patrolling AP only work if you know exactly how the user is bypassing your policy, for example, if Wifi is patrolled, users may still use Bluetooth or USB tethering or Serial port, etc. Patrolling also creates a sense of distrust. |
|
Sep 26 |
comment |
CRIME - How to beat the BEAST successor? perhaps this would start discussions of cryptographically secure compression algorithm. |
|
Sep 21 |
answered | Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? |
|
Sep 21 |
revised |
What defines a programming language as useful for hacking? make the python code more equivalent with C, and reformatting |
