496 reputation
27
bio website
location Redmond, WA
age
visits member for 3 years, 11 months
seen 2 hours ago

Jul
1
comment How to prevent cheating (extra votes) in online contests?
@xperator - students and teachers at what level? If you're at the college level, most colleges/universities issue .edu email addresses. Send a confirmation email there, and you're golden. Is this for a single school district or institution? Then you probably already have access to the roster - just pre-generate the accounts, and hand them out. But the problem is this question (and thus answer) was focused in a different direction than you're actually looking; you more want to prevent duplicate accounts, while the original post was about vote fraud (slightly different).
Jun
11
comment What can i do to trust less on CA's?
You haven't solved the problem, just moved it. - and that touches one of the biggest lies we tech people tell ourselves and others: That technology can solve what are inherently people problems. Identity and trust aren't computer problems, they're people problems.
Jun
7
comment Device Control Policy
@WhiteWinterWolf - ... and what happens if they personally own something from SanDisk (which is a decently popular/available brand)? That's what I was getting at, brand alone is too wide (and it looks like he's only blacklisting storage devices, not keyboards, too).
Jun
7
comment Device Control Policy
@WhiteWinterWolf - the thread you linked to was about VM use? I know blocking USB connections can help against malicious storage, but again, why by brand? I could understand specific models (although it'd still be possible to be lied to), and even better if the device itself has a unique id.
Jun
7
comment Device Control Policy
Why only a specific brand? Note that there's nothing preventing the device from lying to you anyways.
Jun
1
comment Issuing secure tokens that doesn't require any server side state
possible duplicate of Token-based authentication - Securing the token. In response to the second part, there are usually existing tools (or hardware) to manage such keys. Given our current understanding of the math behind them, sufficiently large keys don't 'go bad' and become too easy to figure out after a while - usually they're expired to limit exposure. Side note: you can/should use separate sub-keys for both the SSL connection and the HMAC, if you weren't planning on that already.
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
@SteveDL - the reason I didn't post it as an answer was because this seemed to be more about the practice of erasure, especially for potentially historical reasons. It also wouldn't help him now, if his data is already written, because old sectors and scratch files wouldn't be encrypted unless done from the start. An existing answer mentioning it in an addendum on new best practice would probably be better.
May
24
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
As usual, an ounce of prevention is worth a pound of cure: if you encrypted the drive before use, all you'd need do is throw away the key, rendering the drive unreadable.
Apr
28
comment Malware script uploaded - CPU has been maxed out
1 - keyloggers are considered output of script-kiddies and other amateurs (there are tools to create/deploy them). 2 - Only truly boneheaded programs store saved passwords in the clear, everything else encrypts them to prevent compromise (either from viruses, or opportunistic users). For that matter, most OSs provide an API for such protected storage anyways. If you have the ability to get the stored passwords, you could probably do anything you want.
Apr
28
comment Malware script uploaded - CPU has been maxed out
Absolutely false. Any of the following are possible: Malware sniffs credentials at authentication time (keylogger for passwords) and exfiltrates them, silently adds relevant file/command to stack, malware installs new root certificate/DNS redirect allowing for MITM, prevent the close of the SSH connection and keep using it. The only thing not storing the credentials does is prevent them from being compromised until they're used. Otherwise, anything goes; anything the client machine can do with a person behind it, a rogue process can do too.
Apr
28
comment Malware script uploaded - CPU has been maxed out
SSH would only prevent the connection being snooped from outside (and that's the reason you should use it), but still wouldn't protect against on-machine compromise.
Apr
28
comment Malware script uploaded - CPU has been maxed out
...if his computer is compromised, it doesn't matter if he stores passwords or not, they could be sniffed at type-time (granted, its easier for some attacks, but not really necessary). It would also be possible for any such Trojan to simply upload a kill-script itself.
Apr
12
comment Hidden Malware on a windows OS able to startup
...You could check Amazon. Why do you want to know, exactly? If you're wanting to defend against this kind of thing, your best options are generally: 1) Don't use an admin account (and be careful with UAC-type prompts), 2) Be careful where you go on the internet, 3) Keep your OS up-to-date, and 4) don't plug unknown USB drives into your machine. Generally, the basic protections of an up-to-date OS will do an adequate job of protecting you, so long as no overly facepalm-worthy actions are taken. Anything capable of bypassing them is likely getting in anyways...
Apr
12
comment Hidden Malware on a windows OS able to startup
Well, first you have to get to it. You could always install something while physically present. Otherwise, you have to do it remotely, which means you either need to 1) attack the hardware of the machine (ie, perhaps the network card doesn't properly sanitize all input), or 2) Write regular malware to modify the bootloader/etc. note: if you can get this to run at all, you can probably do whatever you want without going that far. Getting lower is about staying undetected (and opening up more possibilities).
Apr
12
comment Hidden Malware on a windows OS able to startup
A really good hacker modifies the bootloader (the program that starts Windows when you turn the computer on). This would bypass all AV programs, because it would start before the OS and everything else. Microsoft knows this, though, which is one of the (Stated) reasons for UEFI and other secure BIOS bootloaders. Hackers have responded by pushing malware down into hardware. Otherwise... you don't have to register yourself as a service, just co-opt somebody else (by, say, modifying some other service to start you up). Most of the easy stuff is well understood and defended against, now.
Apr
11
comment Copy protection in SD cards
If you load it to the device, you'd have to erase it from the card (or they could load it into a different device)
Apr
10
comment Copy protection in SD cards
Hunh, didn't know about that feature, good find. Of course, then he still has some other problems: 1) has to purchase and implement an encryption license. 2) Limited in what GPS devices can be used, and potentially who is willing to work with you. 3) Required to read from SD card (can't permanently load to device) 4) Have to sell/ship (potentially unique) physical goods. A cursory check shows at least Garmin to be using this feature, dunno about any other company
Apr
9
comment Copy protection in SD cards
Of data? Of some common, open format? Practically impossible. The way you protect data (temporarily) is by using a proprietary format, and creating your own programs or hardware to run it (you get better results if you make the hardware). For non-connected devices (ie, standard GPS receivers) there's nothing you could conceivably do to prevent people sharing some sort of unlock key. Who provides the card? What happens if somebody gets a new GPS unit, are they supposed to buy a new copy of your map?
Mar
17
comment Why Disallow Special Characters In a Password?
Since it's actually easier to increase security by increasing the length of the password, somebody is fooling themself. The kind of people likely to use special characters are probably less likely to forget them, too...
Mar
7
comment Is accidental credit card fraud possible?
Also, usually there's other data on the card that would have to be corrupted - expiration data, CCV, name... It's vanishingly likely that would be randomly corrupted into your data.