2,176 reputation
916
bio website
location
age
visits member for 3 years, 11 months
seen 20 hours ago

1d
comment What is meant by “Use of privileged utility programs” in the ISO27001:2013 standard?
@Julian Knight: if you're in an enterprise who hired a sysadmin that opened emails using their admin account, I would have fired a couple people: the sysadmin and whoever cleared that person for sysadmin privilege. If you can't trust your sysadmin not to know the basics, then you have a bigger issue on hand.
1d
comment What is meant by “Use of privileged utility programs” in the ISO27001:2013 standard?
@JulianKnight: the job of the administrator is to administer the machine, if you have to have a security policy to restrict access to your administrators, then you have a bigger problem. Why are you giving people that aren't qualified to administer the machine administration privilege?
1d
comment Is full disk encryption on a server in a secure data center pointless?
Note that fetching the decryption key from a key server wouldn't really help you from preventing leaks. All it does is allow you to create an audit trail of when the key is accessed.
May
18
comment Any tools like PuTTY for manually stepping through network communications?
What are your actual question you're looking for? Are you only interested in one layer or are you looking for an all-in-one tool stack that lets you step through all layers? The former query is easier, the latter, I have never seen one.
May
18
comment Any tools like PuTTY for manually stepping through network communications?
HTTP is only a single layer, and there are a lot of tools that can do this. To learn the whole OSI stack though, you'll need a tool that can mimic not just HTTP requests, but also simulate the TCP layer, IP layer, then the data and physical layer. The former two are usually implemented by the operating system; the latter two are usually not even accessible by the operating system, so any such tool would have to emulate hardware.
May
17
comment How does crypto help poor people in the third world?
Only a somewhat rich people in poor countries would actually have enough money to save in crypto currency (which offers no interest). And for those that can afford it, it's just as good to do this with regular foreign currency or foreign bank account.
May
14
comment Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
There is known plain text attack. If the attacker have a pretty good idea of what the message is about, they may be able infer what the message contains by looking at the encrypted size. Encrypting with larger block size makes this kind of attack more difficult.
May
14
comment Securing Data at Rest in Android
What are your that model? Why are you worried about restricting access? Copyright violations? Sensitive PII? Government Top Secret? Technologically, you cannot completely prevent redistribution of streamed videos; you can make it harder, and you can plant the data with identifying marks to track leakages. All these can be circumvented by a sufficiently sophisticated attacker.
May
12
comment IoT Devices and 39 Month TLS Certificate Life
possible duplicate of TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
May
12
revised Safely remove original file after encryption
added 22 characters in body
May
12
answered Safely remove original file after encryption
May
11
comment Is it truly possible to store passwords securely, but be able to see the password?
@IsmaelMiguel: none of which make things actually more secure
May
11
awarded  Nice Answer
May
11
answered Is it truly possible to store passwords securely, but be able to see the password?
May
3
comment Detecting Hardware keyloggers… elegant solutions?
ATMs are basically a computer in a tamper proof safe, and they still can't prevent keypad skimming device.
May
3
comment What Steps Does An Anonymous Artist Need To Take to Retain Anonymity?
I think you're confusing between privacy and anonymity. As an artist, you probably do want to build an identity, but you just don't want that identity to be associated with your real identity. What you need in this case is to publish your materials under an alias with a publisher that respects your privacy and can advise you on how to stay private. The solution for this is not (just) technological.
May
3
comment If someone steals my laptop while I'm logged in, how can I protect my browser?
I put all my machines to lock and suspend after a minute of inactivity. Any password keyrings should also be setup to automatically relock when the machine is locked/suspends. And I habitually lock the machine when leaving it for lunch or toilet. There's also full disk encryption. I would also use 2FA whenever they are available
Apr
30
comment How can I detect unencrypted self-executing code in JPEG images?
@pgmank: knowing JPEG's structure, one can detect if the image contains superfluous information. However, there are many legitimate uses of embedding superfluous information, and if the antivirus flags all such files, it'll reduce its effectiveness as people will be ignoring its warnings. The antivirus would have to actually understand what the superfluous information is to reliably distinguish legitimate and illegitimate superfluous information, and that is a halting problem.
Apr
30
comment How can I detect unencrypted self-executing code in JPEG images?
@pgmank: With metamorphic code, yes, the decryptor is in unencrypted code. However, a sophisticated metamorph could be written such that an antivirus couldn't reliably determine whether a file is clean or not due to halting problem.
Apr
29
comment Signing the Recovery Partition
The way X.509 digital signature works, you shouldn't need to know the individual partition's hash, but only the public key of the signer.