2,526 reputation
1018
bio website
location
age
visits member for 4 years, 1 month
seen Jul 26 at 16:26

Jul
26
comment kernel: Intrusion disconnecting me
Strictly speaking, DDoS doesn't have to involve lots is traffic, only that your service is disrupted for legitimate users. Volumetric DDoS is the most commonly talked about, but it isn't the only type of DDoS
Jul
20
awarded  Caucus
Jul
10
comment Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?
Why not host your own email? Because it doesn't actually improve security. If you care about email security (and you should), you'd use end to end email encryption, i.e. PGP.
Jul
8
comment 3rd party SSL security and having an extra layer of SSL
Of this 3rd party eCommerce company takes credit card transaction and doesn't have a good security (e.g. No HTTPS between the customer and the server), then you can be sure that they're violating PCI-DSS. If you have good evidence of their insecurity, you may want to find another eCommerce provider, or check out what actions you can take legally against the eCommerce company.
Jul
6
answered Can Client Certificates be tied to a Specific Server Certificate?
Jul
6
comment Is it possible to decrypt a satellite TV signal without using a smart card?
@Awena: who says there's no market for manufacturing unlocked/modified set-top box?
Jun
23
comment Why can't reverse engineering be automated?
@raz: yes, your answer is perfectly fine for the question; my comment was going on the tangent about the reverse engineer aspect that you brought up. ... the heuristic engine still doesn't understand exactly what the malware does. Only that it's actions are statistically malware. on which I argue is exactly what a human reverse engineer would be doing. Even a moderately experienced reverse engineer is still a lot better in this task than the most sophisticated heuristic engines though, but the methods aren't really that different.
Jun
23
comment Decrypting TOR traffic?
@raz: Tor doesn't guarantee anonymity either, if you send personally identifiable data over the Tor connection without an additional end-to-end encryption, the Tor exit node can trivially obtain ny unencrypted data you send over the exit node. The only thing that Tor guarantee is that Tor itself does not leak anonymity; your traffic may leak your anonymity.
Jun
23
comment Why can't reverse engineering be automated?
If you are really talking about "reverse engineering", not just "decompilation", then the problem is that you are fighting against the Halting Problem. Nevertheless, this doesn't stop antivirus and IDS/IPS writers from creating a heuristic analysis engine which is essentially an automatic reverse engineering system.
Jun
21
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: if you are doing encryption on the client side, you must protect the client against compromise/virus/etc. If you do the encryption on the server side, you must protect both the client and the server against compromise/virus/etc. The latter just have more attack surfaces. If the client is compromised, you must consider the data coming from them as compromised, especially if the data is not encrypted by the client. Encrypting the data on client side, does not make client compromise any worse.
Jun
21
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: the problem is that your first requirement states "... the users to know that even the staff cannot access their data". Doing encryption on server side means this requirement is impossible, it's no longer just a matter of trust. You might as well just use no encryption or a single encryption key for all users (e.g. full disk encryption), they're much simpler to implement and more importantly the security isn't any different.
Jun
18
comment Which strategy to encrypt data accessed by multiple users?
@BenjaminSinclaire: if you are encrypting on the server, then it is broken by design because your server will have the data in plain text at some point. Any malicious tech staff/attacker can just grab the data before it gets encrypted. As to your second point, if the client is insecure, then the user are already screwed whether you do the encryption on client side or server side. The risk of leaks are much higher if you do not encrypt end to end.
Jun
17
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: a security conscious user should not trust the server's claim that an encryption key belongs to another user. This is similar to how PGP's Web of Trust works does not depend on PGP keyservers. Like PGP, the security conscious user should verify other users's user-key out of band, so the client must have mechanism to view and compare user-key. Although the concept described here would work with any strong asymmetric encryption algorithm, I'd recommend actually using GPG to implement the asymmetric encryption here; it's a mature implementation and widely understood.
Jun
17
comment Which strategy to encrypt data accessed by multiple users?
@KevinKeane: for best security, the client has to be open sourced and has deterministic build. A security conscious user can audit the source code and compile the client themselves. With the user being able to trust the client, the user does not need to trust the server operator at all, because no sensitive information is ever sent to the server and the server cannot forge malicious data. The most damage the server operator can do, is delete data.
Jun
17
comment SSL is Extended Validation more secure?
To summarize, domain validation is all about tying the connection with the domain name, while extended validation is about tying the connection with not just the domain name but also a physical business. The big flaw with EV certificate though, it relies on the user to care and enforce it.
Jun
17
comment SSL is Extended Validation more secure?
@mcgyver5: you're probably seeing certificate pinning in action
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
deleted 4 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 1 character in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body
Jun
17
revised Which strategy to encrypt data accessed by multiple users?
added 931 characters in body