Reputation
5,063
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
12 24
Newest
 Good Answer
Impact
~135k people reached

13h
comment What is a good way to generate a one time pad, and is this a good way?
Just had to point out, /dev/urandom is a pseudo random number generator. It is considered cryptographically secure because it is constantly reseeded from environmental noise, but there is a pseudo random number generator in its pipeline.
1d
answered How much can we trust open source implementations of crypto (security) libraries?
2d
answered Linux equivalent to Windows WriteProtect key in the registry for a software based write blocker?
Feb
6
comment What is the best way to organize OpenPGP keys?
@gikel3888: other people need your S and C public key to verify signatures and keys that you have signed with them. The Master's public key is a trust anchor, it cannot be directly used to verify the signatures made by its subkey. Signatures made by a subkey can only be verified with the subkey's public key; but the subkey's public key will only be trusted if it is signed by the C key from your Master Key, which is the trust anchor.
Feb
6
comment Is it completely safe to store the unencrypted credentials within a variable in the ios device
What is your threat model?
Feb
6
revised What is the best way to organize OpenPGP keys?
added 41 characters in body
Feb
6
comment What is the best way to organize OpenPGP keys?
@gikel3888: as to your first comment, I believe you are correct, yes. Note that you can still decrypt data using an expired (E) key; the expiry is for other people, they are not supposed to encrypt to you using expired (E) key, as that is considered insecure. Note that this means that if you want to be able to read old data, you must never delete expired (E) private key even if you create and publish a new (E) private key.
Feb
6
comment What is the best way to organize OpenPGP keys?
Tested on my machine just now, gpg2 --gen-key creates two keys: master key pair with SC and a subkey pair with E.
Feb
6
revised What is the best way to organize OpenPGP keys?
added 110 characters in body
Feb
6
revised What is the best way to organize OpenPGP keys?
added 17 characters in body
Feb
6
answered What is the best way to organize OpenPGP keys?
Feb
6
comment Is it safe storing revision history on production servers?
@drewbenn: also, you can set git to just do a shallow clone, so no full history.
Feb
6
comment Why don't OSes protect against untrusted USB keyboards?
Implementation of this kind of feature will have to be optional and be turned on from the BIOS. Most users will not fully understand why they have to approve the keyboard, and those people who care about such issues will most likely reserve a dedicated trusted keyboard that is used just to enable this feature. So from usability perspective, it's a non-issue.
Feb
6
comment Why don't OSes protect against untrusted USB keyboards?
Why does it need to type in password? The OS or BIOS can display a prompt and the user click OK. And then you've got the same issue with potentially malicious mouse.
Feb
5
comment A code protector claims that it “ensures it is physically impossible to run code without a serial number” is this a scam?
It's possible that the license key is used to decrypt parts of a software, which would make it impossible to run those protected parts without the key. It still doesn't solve that if someone have a key, they can then decrypt and share the protected part.
Feb
4
comment While working from home, is it a bad idea to give the company you work for your IP address?
IP white listing isn't necessarily a sign of poor security practices if IP white listing is done in addition to a strong authentication method. The main reason for IP white listing is because IP white listing is enforced by a layer 3 firewall, which is a much faster and simpler device then higher layer firewalls that have to parse through more of the layers and/or maintain TCP sessions. IP blocking device can sift through a large volumetric attacks quickly and efficiently with modest hardware with little performance impact.
Feb
2
comment Explain to non tech savvy person how to check that your connection to mybank.com is safe?
@SteveDL: EV and OV ties a domain name with a real life business identity. For most people, telling them to look for their banks name in the EV bar should be sufficient to assure them that they're really connecting to who they think they're connecting to, for better assurance, users can also check the physical address and company registration number matches what they expect and check for usage of HSTS and HPKP. Beyond that, yes, they should bookmark the site and access them only through the bookmark.
Feb
2
comment Explain to non tech savvy person how to check that your connection to mybank.com is safe?
@SteveDL: the true strength of EV certificate should be considered when you combine it with the other related technologies. In particular, strong transport security and key pinning. EV certificate gives you strong identity validation, and when combined with strict transport security and key pinning means you only need to fully check the certificate identity the first time you load a site.
Feb
1
comment How can I protect myself from false accusations when our company practices password escrow?
@Theraot: another argument for frequent password change is that the attacker manage to obtain the plaintext of the password (e.g. keylogger, shoulder surfing) but did not actually use it for some time to mask the incident where he managed the chance to obtain the password. Frequent change limits the window of such attacks to just the vulnerable time.
Feb
1
comment Explain to non tech savvy person how to check that your connection to mybank.com is safe?
EV CAs also have to checks that the business is active business in a good standing according to the business database (e.g. registered for more than three years, pays taxes). The CA do a face-to-face verification of the primary contact of the organization or that the qualified business database had done face-to-face verification when entering the information to their database. You can't just register a company last week then apply for EV certificate now.