466 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years
seen yesterday

Jul
26
comment Database compromised and some passwords cracked
...When you're running a web server, you're supposed to turn off verbose error messages (displayed to users) in the first place. This sounds like you put this setting in the other direction, frankly. And you need to make sure people don't just reuse their old password, too, or safely resetting it is going to be pointless.
Jul
26
comment Track my girlfriend's stolen computer
@RSFalcon7 - Maybe you can't get this information, but I'm wondering if Google/Facebook will log attempts with a recently expired password? You're going to have to turn this information over to the police anyways...
Jul
17
comment Restricting source code to domain name
What happens if they change their domain name? Due to trademark disputes, business merge, whatever. Note that most system admins hate automated updates to production systems, because it can cause things to break unexpectedly. What do you mean by "source code" - if you distribute the source it makes removing protections much easier. If you're not really worried about piracy, why use DRM?
Jul
13
comment How long does it take for Google to detect click fraud and suspend an AdSense account?
If I remember right, serving an ad is an impression, and getting somebody to buy something afterwards (or whatever it is that you're "selling") is called a conversion. Any marketing manager wants the ratio to be 1. If a source of impressions isn't getting you any conversions, you drop it (because it's bringing your numbers down, and costs you money). If an ad network doesn't have tools to find this sort of behavior (at minimum with an anonymized id), it's inadequate.
Jul
6
comment Where to save digital content and prevent sharing?
This is DRM. All major companies have found, despite millions or billions of dollars spent, that you can't stop this, long term. The moment you give somebody a file, they're able to give it to somebody else (they don't even need to redownload it). You can delay it somewhat by using nonstandard file types and a custom reader, but it won't stop people, and will just annoy everybody else. In fact, historically, that's mostly what DRM has done - annoy the legitimate users. Ubisoft failed so bad people were running pirated versions because the copy they bought was giving them grief.
Jul
6
comment How to defend against auto-scanning license plate cameras? (computer vision)
You might get in trouble if it prevents law-enforcement readers from operating. You might check if your local jurisdiction has rules against obscuring plates. If the system alerts cops that you're doing something like this, they might pull you over to find out why. This would have to be on 24/7 to prevent reads while parked, watch out for draining the batteries. If your car gets stolen, this will work against you.
Jul
5
comment Is this a bot fishing for security vulnerabilities on my site?
@birdieblue - Perhaps you've been targeted by a bot randomly crawling the web? It's not necessarily something that you can determine without a lot of research.
Jun
29
comment Is it possible to implement a secure game without having a reliable arbiter?
This, as in so many other problems, isn't really a technical problem, it's a people problem. The only thing different about the computer is they have a terrible time with random numbers. You'd face the exact same problem in a regular board-game version of chess. Why do you think major tournaments have judges for games? Consider the computer an extension of the player, solely a vector for playing the game, and you'll be thinking in the right direction; that is, what happens if you play a normal board game over Skype or similar?
Jun
20
comment Is providing a website password over the phone any less secure than other identifying information?
As opposed to the information you are giving them, which is potentially sufficient for identity theft? The touchtone password is probably safe from the CSR, at least.
Jun
20
comment Is providing a website password over the phone any less secure than other identifying information?
@Schroeder - who decides the "random" letters? What happens when dealing with something like Arabic, where some letters combine in words (so computer output might not be correct, or otherwise match what a person gives)? If the CSR doesn't ask you the question, it's essentially a call-in pin (of only two digits). If they do, it's likely to be publicly available information. Too, some people are going to have a hard time figuring out character index, and so will write it down... potentially permanently. I dislike that scheme.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
As a side note, the only reason to use two fields for the new password is to check that they match what the user expects, not what you expect/need. This can be trivially performed with JavaScript, so you don't need to send two fields to your server (or perform that check there). You'll still need to perform the other checks on your server, of course.
Jun
20
comment Hashing Email Address and Contacting User
What happens if somebody uses the same email for multiple accounts? Which do you return when you get them all? Or do you only return one? Related to that, what does your system return if it doesn't find an email address? You need to secure signup/login/recovery pages in such a way that returned messages can't be used to harvest such information.
Jun
16
comment how can I tell if I'm under IMSI cell phone surveillance
@JulianKnight - sure, these devices are all over the place. What I'm getting at, though, is that this person has already been arrested, and some of his property confiscated; the police probably have enough to get a warrant for data from the cell companies. If they don't have one, anything such a device collects could (maybe, talk to lawyer) be thrown out - at minimum, the ACLU would love such a case. So the use of the device is really secondary here...
Jun
15
comment how can I tell if I'm under IMSI cell phone surveillance
They'd have to be bored to be sitting outside your apartment with something to pick up your calls. Remember, the mobile phone is connecting through a network, just like a wired phone. The government doesn't bother going to the endpoint, they just have the central network give it to them. They might be having the network ping the number for data locations more often (or possibly driving by some of the time) to verify your (phone's) location, but I'd start with the device just being faulty. Unless somebody may have hired a PI too?
Jun
15
comment how can I tell if I'm under IMSI cell phone surveillance
Also, the app doesn't appear complete, so I'm not sure how helpful that would be.
Jun
14
comment Help with successful Internal intrusions
Moreover, even on most embedded solutions, memory address locations aren't (usually) going to stay the same (essentially to prevent behavior related to this) between application/machine start. So the information would be largely useless anyways. I agree with pfyon - you need to have him document his work, if for no other reason so as to enable you to close the gaps.
Jun
10
comment HTTPS still NSA-safe?
https is itself a protocol, which can choose from one of a number of different algorithms, some of which are already known to be broken. Which one to use is negotiated between the server and the client, so if they pick a known broken one...
Jun
7
comment copy protection (or licensing) mechanism for an android app
... there might be a problem with that - some tablets/phones likely don't allow such sideloading without developer accounts. Also, if the device is on contract, they may get it replaced - which would be a major problem if you do device locking. Note that doing it this way would require an unusual install path - you have to tell the OS to install from an untrusted source (look for instructions online), which people are often leery to do, for obvious reasons. It appears the store has built-in licensing, too...
Jun
7
comment copy protection (or licensing) mechanism for an android app
... If it's present on the client device, it's findable. You'd be better off to do something with a public/private key hash, thus no secret value to find. In fact, doing it in this fashion is likely more noticeable, because of the checks and success/failure. In the case of IM apps, they're usually talking to a server to pass messages, so can simply refuse requests from unregistered accounts. Heck, if you're using something this simple, I'd just dummy out the method call - normally these verifications have to be spread throughout the client code.
Jun
7
comment copy protection (or licensing) mechanism for an android app
Out of curiosity, why aren't you distributing through a regular store? Traditionally, it's not the "common" end users (those without the necessary ability) you actually have to worry about, it's the bored people who do. These people aren't even necessarily your target audience! Low price and a simple/quick/easy registration process (combined with an app that doesn't react adversely) are your best defense against these people. I'd actually advise against a machine-locking scheme, especially with something like an android tablet, unless you have a simple way to switch legitimate machines.