Reputation
516
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 7
Newest
 Yearling
Impact
~10k people reached

  • 0 posts edited
  • 13 helpful flags
  • 12 votes cast
Apr
23
comment Is it safe to include memory addresses in a program’s output?
@VasiliyFaronov - because the memory addresses disappear, and change between subsequent runs. They're meaningless outside of the linking performed internal to your program. You should be outputting something that does have meaning to your user (and preferably stable, although this may not be possible in all situations).
Mar
30
comment Is it possible to crack g++ rand()?
Why do you want to find the one that comes next? Why can't you just generate a new random value? Note that the method isn't completely secure anyways, since rand() doesn't return crypto-level results, and the mod afterwards will skew to one side (since the range of the random is not a multiple of the alphabet size).
Mar
13
comment What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
@Saibot - The fact that the firmware might be open source is immaterial to security concerns if you don't have a trusted setup. You wouldn't accept a Linux box from Joe Random claiming it's secure, would you? You'd have an easier time verifying the (non)security in that case, but it's the same problem. It's the problem mentioned in the Reflections On Trusting Trust link mentioned in another answer; you need to trust the entire chain, not just what you can observe.
Mar
13
comment What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
@Saibot - depends, how did it get loaded onto the hardware? Did you load it yourself, while assembling the board from component parts? If the answer is "no", then it can still be backdoored (and sometimes even if you did...). Will it be the same binary? No, but you might not have any way to observe that, and because you usually have to ask the firmware questions about itself/to perform update functions, it can lie.
Mar
13
comment What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
@Saibot - false, it's possible to backdoor via hardware too. Unless you make everything yourself (and I do mean everything, including your own chip masks), you always have an avenue for somebody else to slip in a back door. Have fun~!
Mar
9
comment How to prevent cheating (extra votes) in online contests?
@kojow7 - ouch, you're right. Still, it was likely that the poster was asking about an American product...
Dec
21
comment Is One-Time pad used anywhere?
Distribution is still a problem. You need a key for each direction. For instance, what happens if Embassy A wants to send a message to Embassy B? You'd need a set of keys just for them (since you might not want Embassy C to listen in). Much easier to just give everybody a private key. There are procedure problems with things like timing of messages, given you have to know where each message started, and how long it was (so either you observe a strict receive order, or you need to add that info, unencrypted, which gives more info to an attacker).
Dec
3
comment Can I replace username and password with a long random text in URL?
Vulnerable to sniffing if it isn't done over https (and you don't have complete control over that, actually). More vulnerable to theft if the users computer is infiltrated (well-implemented "remember me" functionality is more secure), and then you somehow have to re-issue. If people aren't remembering passwords now, wouldn't they already be writing them down on post-it notes? I seriously doubt a 30-character one is going to help there...
Nov
13
comment Does salt increase security if there is only a single hashed password?
@techraf - because nobody calculates rainbow tables for anything the size of a typical salt. Random 8-character alpha-numeric passwords would take 24 terabytes (without the resulting hash!), and salts are usually longer still. You could calculate a table for a single salt, but it would only be useful once, essentially, and since you'd get the salt at the same time as the password, building the rainbow table would be equivalent to cracking the hash.
Nov
7
comment not allowing pasting of bank account number
99% of common users, and a good percentage of "technical" ones, have no concept of good security in the first place, much less even consider the implications of the copy buffer. that is, this really only annoys end users. Further, since it doesn't prevent you from doing the copy, it fails at the implied goal anyways...
Sep
22
comment Can my mouse have virus and infect other machines?
@ChrisH - Only some of them it is, then!
Sep
22
comment Can my mouse have virus and infect other machines?
@LieRyan - Unlikely. As most of the other answers are pointing out, basic mice aren't usually reprogrammable (I'm ignoring a straight up factory-made-malicious device, which wouldn't need you to do more than plug it in). Macro-enabled mice are dependent on PC-side programs and special drivers for that functionality (all of them, I assume), and aren't reprogrammable either. Ergo, the mouse itself is incapable of being the vector.
Sep
21
comment Can my mouse have virus and infect other machines?
Yeah, but for the PC-side program to have any bearing in that case you'd have to transfer the data somehow, at which point you're asking "I transferred program data from A to B, could I be compromised". The macro function itself is a red herring, and is unlikely to be an additional vector when moving to a new machine. Telling the macro to execute an attack (say, open a command prompt) would require the same access as actually executing the attack, so isn't interesting. Distributing a malicious profile would work better, since most people don't check them like .bat files...
Sep
21
comment Can my mouse have virus and infect other machines?
Most macro-function devices I'm aware of don't actually reprogram the device, they just tell the driver/controller to execute some additional function.
Aug
15
comment How to encrypt or store data so that only a pool of processes can share it on Windows?
Wait, what are you trying to prevent here? A user having (their?) data stolen from a compromised machine? Your data being stolen by the end user?
Jul
1
comment How to prevent cheating (extra votes) in online contests?
@xperator - students and teachers at what level? If you're at the college level, most colleges/universities issue .edu email addresses. Send a confirmation email there, and you're golden. Is this for a single school district or institution? Then you probably already have access to the roster - just pre-generate the accounts, and hand them out. But the problem is this question (and thus answer) was focused in a different direction than you're actually looking; you more want to prevent duplicate accounts, while the original post was about vote fraud (slightly different).
Jun
11
comment What can I do to rely less on certificate authorities?
You haven't solved the problem, just moved it. - and that touches one of the biggest lies we tech people tell ourselves and others: That technology can solve what are inherently people problems. Identity and trust aren't computer problems, they're people problems.
Jun
7
comment Device Control Policy
@WhiteWinterWolf - ... and what happens if they personally own something from SanDisk (which is a decently popular/available brand)? That's what I was getting at, brand alone is too wide (and it looks like he's only blacklisting storage devices, not keyboards, too).
Jun
7
comment Device Control Policy
@WhiteWinterWolf - the thread you linked to was about VM use? I know blocking USB connections can help against malicious storage, but again, why by brand? I could understand specific models (although it'd still be possible to be lied to), and even better if the device itself has a unique id.
Jun
7
comment Device Control Policy
Why only a specific brand? Note that there's nothing preventing the device from lying to you anyways.