Reputation
516
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 7
Newest
 Yearling
Impact
~9k people reached

  • 0 posts edited
  • 12 helpful flags
  • 12 votes cast
Dec
21
comment Is One-Time pad used anywhere?
Distribution is still a problem. You need a key for each direction. For instance, what happens if Embassy A wants to send a message to Embassy B? You'd need a set of keys just for them (since you might not want Embassy C to listen in). Much easier to just give everybody a private key. There are procedure problems with things like timing of messages, given you have to know where each message started, and how long it was (so either you observe a strict receive order, or you need to add that info, unencrypted, which gives more info to an attacker).
Dec
3
comment Can I replace username and password with a long random text in URL?
Vulnerable to sniffing if it isn't done over https (and you don't have complete control over that, actually). More vulnerable to theft if the users computer is infiltrated (well-implemented "remember me" functionality is more secure), and then you somehow have to re-issue. If people aren't remembering passwords now, wouldn't they already be writing them down on post-it notes? I seriously doubt a 30-character one is going to help there...
Nov
13
comment Does salt increase security if there is only a single hashed password?
@techraf - because nobody calculates rainbow tables for anything the size of a typical salt. Random 8-character alpha-numeric passwords would take 24 terabytes (without the resulting hash!), and salts are usually longer still. You could calculate a table for a single salt, but it would only be useful once, essentially, and since you'd get the salt at the same time as the password, building the rainbow table would be equivalent to cracking the hash.
Nov
7
comment not allowing pasting of bank account number
99% of common users, and a good percentage of "technical" ones, have no concept of good security in the first place, much less even consider the implications of the copy buffer. that is, this really only annoys end users. Further, since it doesn't prevent you from doing the copy, it fails at the implied goal anyways...
Sep
22
comment Can my mouse have virus and infect other machines?
@ChrisH - Only some of them it is, then!
Sep
22
comment Can my mouse have virus and infect other machines?
@LieRyan - Unlikely. As most of the other answers are pointing out, basic mice aren't usually reprogrammable (I'm ignoring a straight up factory-made-malicious device, which wouldn't need you to do more than plug it in). Macro-enabled mice are dependent on PC-side programs and special drivers for that functionality (all of them, I assume), and aren't reprogrammable either. Ergo, the mouse itself is incapable of being the vector.
Sep
21
comment Can my mouse have virus and infect other machines?
Yeah, but for the PC-side program to have any bearing in that case you'd have to transfer the data somehow, at which point you're asking "I transferred program data from A to B, could I be compromised". The macro function itself is a red herring, and is unlikely to be an additional vector when moving to a new machine. Telling the macro to execute an attack (say, open a command prompt) would require the same access as actually executing the attack, so isn't interesting. Distributing a malicious profile would work better, since most people don't check them like .bat files...
Sep
21
comment Can my mouse have virus and infect other machines?
Most macro-function devices I'm aware of don't actually reprogram the device, they just tell the driver/controller to execute some additional function.
Aug
15
comment How to encrypt or store data so that only a pool of processes can share it on Windows?
Wait, what are you trying to prevent here? A user having (their?) data stolen from a compromised machine? Your data being stolen by the end user?
Jul
1
comment How to prevent cheating (extra votes) in online contests?
@xperator - students and teachers at what level? If you're at the college level, most colleges/universities issue .edu email addresses. Send a confirmation email there, and you're golden. Is this for a single school district or institution? Then you probably already have access to the roster - just pre-generate the accounts, and hand them out. But the problem is this question (and thus answer) was focused in a different direction than you're actually looking; you more want to prevent duplicate accounts, while the original post was about vote fraud (slightly different).
Jun
11
comment What can I do to rely less on certificate authorities?
You haven't solved the problem, just moved it. - and that touches one of the biggest lies we tech people tell ourselves and others: That technology can solve what are inherently people problems. Identity and trust aren't computer problems, they're people problems.
Jun
7
comment Device Control Policy
@WhiteWinterWolf - ... and what happens if they personally own something from SanDisk (which is a decently popular/available brand)? That's what I was getting at, brand alone is too wide (and it looks like he's only blacklisting storage devices, not keyboards, too).
Jun
7
comment Device Control Policy
@WhiteWinterWolf - the thread you linked to was about VM use? I know blocking USB connections can help against malicious storage, but again, why by brand? I could understand specific models (although it'd still be possible to be lied to), and even better if the device itself has a unique id.
Jun
7
comment Device Control Policy
Why only a specific brand? Note that there's nothing preventing the device from lying to you anyways.
Jun
1
comment Issuing secure tokens that doesn't require any server side state
possible duplicate of Token-based authentication - Securing the token. In response to the second part, there are usually existing tools (or hardware) to manage such keys. Given our current understanding of the math behind them, sufficiently large keys don't 'go bad' and become too easy to figure out after a while - usually they're expired to limit exposure. Side note: you can/should use separate sub-keys for both the SSL connection and the HMAC, if you weren't planning on that already.
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
@SteveDL - the reason I didn't post it as an answer was because this seemed to be more about the practice of erasure, especially for potentially historical reasons. It also wouldn't help him now, if his data is already written, because old sectors and scratch files wouldn't be encrypted unless done from the start. An existing answer mentioning it in an addendum on new best practice would probably be better.
May
24
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
As usual, an ounce of prevention is worth a pound of cure: if you encrypted the drive before use, all you'd need do is throw away the key, rendering the drive unreadable.
Apr
28
comment Malware script uploaded - CPU has been maxed out
1 - keyloggers are considered output of script-kiddies and other amateurs (there are tools to create/deploy them). 2 - Only truly boneheaded programs store saved passwords in the clear, everything else encrypts them to prevent compromise (either from viruses, or opportunistic users). For that matter, most OSs provide an API for such protected storage anyways. If you have the ability to get the stored passwords, you could probably do anything you want.
Apr
28
comment Malware script uploaded - CPU has been maxed out
Absolutely false. Any of the following are possible: Malware sniffs credentials at authentication time (keylogger for passwords) and exfiltrates them, silently adds relevant file/command to stack, malware installs new root certificate/DNS redirect allowing for MITM, prevent the close of the SSH connection and keep using it. The only thing not storing the credentials does is prevent them from being compromised until they're used. Otherwise, anything goes; anything the client machine can do with a person behind it, a rogue process can do too.
Apr
28
comment Malware script uploaded - CPU has been maxed out
SSH would only prevent the connection being snooped from outside (and that's the reason you should use it), but still wouldn't protect against on-machine compromise.