2,028 reputation
915
bio website
location
age
visits member for 3 years, 11 months
seen 4 hours ago

1d
comment Detecting Hardware keyloggers… elegant solutions?
ATMs are basically a computer in a tamper proof safe, and they still can't prevent keypad skimming device.
1d
comment What Steps Does An Anonymous Artist Need To Take to Retain Anonymity?
I think you're confusing between privacy and anonymity. As an artist, you probably do want to build an identity, but you just don't want that identity to be associated with your real identity. What you need in this case is to publish your materials under an alias with a publisher that respects your privacy and can advise you on how to stay private. The solution for this is not (just) technological.
1d
comment If someone steals my laptop while I'm logged in, how can I protect my browser?
I put all my machines to lock and suspend after a minute of inactivity. Any password keyrings should also be setup to automatically relock when the machine is locked/suspends. And I habitually lock the machine when leaving it for lunch or toilet. There's also full disk encryption. I would also use 2FA whenever they are available
Apr
30
comment How can I detect unencrypted self-executing code in JPEG images?
@pgmank: knowing JPEG's structure, one can detect if the image contains superfluous information. However, there are many legitimate uses of embedding superfluous information, and if the antivirus flags all such files, it'll reduce its effectiveness as people will be ignoring its warnings. The antivirus would have to actually understand what the superfluous information is to reliably distinguish legitimate and illegitimate superfluous information, and that is a halting problem.
Apr
30
comment How can I detect unencrypted self-executing code in JPEG images?
@pgmank: With metamorphic code, yes, the decryptor is in unencrypted code. However, a sophisticated metamorph could be written such that an antivirus couldn't reliably determine whether a file is clean or not due to halting problem.
Apr
29
comment Signing the Recovery Partition
The way X.509 digital signature works, you shouldn't need to know the individual partition's hash, but only the public key of the signer.
Apr
29
answered Best practice for caching sensitive data
Apr
15
answered Requesting webpage as DOS
Apr
13
answered Is it possible that to sign a message with a PGP key in a way that leakes the key
Apr
5
awarded  Student
Mar
25
answered SQL Injection in a Web Service URL as a Parameter Value
Mar
22
comment Might Google log every website I visit using Chrome?
I'm rather hesitant to vote on this since this answer is entirely speculation. If you actually observe this in wireshark, you should tell what exactly you're observing. Did you just notice that there is traffic, or did you actually observe what's in the traffic? Why do you have so many "probably"s in your answer?
Mar
21
answered Would a VPN with changing configs do the same job as different VMs
Mar
20
revised Should a server be considered compromised simply because a port was open?
edited body
Mar
20
awarded  Nice Answer
Mar
20
comment Is Diffie-Hellman key exchange the best way to securely exchange SSH keys?
@5drive: you can also push the file within the websocket directly if you want. Pushing large file with websocket isn't a good idea for browser based application, but you're not writing a browser-based application anyway, I believe, so that doesn't apply.
Mar
19
comment Is Diffie-Hellman key exchange the best way to securely exchange SSH keys?
@5drive: can't the device just open a WebSocket to get push notifications, and download the files it need from the server with regular HTTPS connection? If you don't need the real time push, you can also just poll the server from time to time to get the list of files to download.
Mar
19
answered Is Diffie-Hellman key exchange the best way to securely exchange SSH keys?
Mar
19
revised How do I recover from an email breach?
added 42 characters in body
Mar
19
answered How do I recover from an email breach?