439 reputation
25
bio website blog.digitalliberalism.eu
location Nederland
age 26
visits member for 3 years, 4 months
seen Apr 26 '13 at 17:53

MSc student with the Kerckhoffs Institute for Computer Security -- a collaborative effort of the Eindhoven University of Technology, the Radboud University, and the University of Twente.


Aug
1
awarded  Yearling
Nov
2
comment Is it safe to use virtual machines when examining malware?
Are these known forms of malware? I.e. do you know what kind of threat they pose (by using a virus encyclopedia) or may they perform unknown actions? Of course, it is never safe to make too many assumptions on their respective threats, but, for example, if you obtained them from an anti-virus company for scientific purposes their behaviour in virtual machines may be known to the extent where you can decide if it is too much of a risk to run them in a virtual machine.
Aug
20
comment How to store chat conversations on my website?
From what I read, this website does not really have security requirements that justify the problems raised by encrypted data in the database. Searching and indexing becomes hard, looking at message computational expensive, and if you want to have a formally sound scheme, you need to devise some sort of browser plugin for the encryption, as else the key would reside on the server, where it is probably easily stolen. (Surely if only the db is compromised, that is not true, but I imagine those cases to be rare. Commonly, the attacker will also find a way to the application.)
Aug
1
awarded  Yearling
Apr
17
comment Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?
SetEnv is passed to all cgi scripts for which that part of the .htaccess file is evaluated (although those scripts may also be able to access a config.php file). Furthermore, it may appear on print_r's of the _SERVER variable, such as in phpinfo().
Apr
4
comment What steps should one take to provide “reasonable” levels of privacy from a government?
Given that most small and medium users have a virtual server, is FDE a solution at all?
Apr
2
comment What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I would recommend a signed and written statement, as you are entering a field where high criminal charges do occur. This is how it is often done with professional penetration tests.
Mar
28
comment Best practice for password distribution
In that case, you are already advocating a two channel approach, where one channel is more trustworthy -- thus, it is very hard to modify the key in both channels. In other words, security of the key distribution is due to the trustworthy channel, not due to the specific encryption tool used. It is very important to realise that trust cannot be bootstrapped out of thin air, whatever approach to cryptography you use. Thus, think in terms of trust in the first place, and about the cryptographic means in the second place. Else, you are bound to make wrong assumptions.
Mar
28
comment Best practice for password distribution
No, if the public key is send over an untrusted channel it may be altered, thereby causing the password to be encrypted wrongly and interceptable. Edit: the only positive factor of public key encryption here is that it is easier to note that it has been intercepted, as the original receiver is unable to decrypt it.
Mar
28
comment Best practice for password distribution
That approach is no more secure than using a temporary symmetric key that is told by a separate channel, e.g. phone.
Mar
28
comment Is it possible to turn a computer into a bomb?
Given that there already were stories on how the firmware of notebook batteries could be infected, shouldn't someone be able to use this to make the battery explode? It will probably cause not so much damage, but I can see it happening. Just don't know why an attacker would do so, if they could just start stealing your banking information instead...
Mar
28
comment Encryption laws in India — is it allowed to use ssh and VPN?
Not sure if applicable here, but legislation tends to differentiate between stored data and data in transit.
Mar
28
comment How to check if a software is legitimate
trustfull --> trustworthy?
Mar
28
comment Is it alright to tell everyone your encryption information?
I find this a very good thing, it actually enables me as a customer to evaluate their security! Keeping these things secret is just security by obscurity, which is generally not helpful at all.
Mar
28
comment Best practice for password distribution
@YoavAner if you have a secure channel to find these things, why don't you use that channel for key distribution to begin with? You are assuming the stated problem to be non-existent.
Mar
28
comment Best practice for password distribution
@YoavAner Who says that the stackexchange profile with your name on it is actually yours to begin with? These are exactly the type of assumptions social engineers attack.
Mar
28
comment Best practice for password distribution
Anyhow, I've tried to give my answer more structure.
Mar
28
comment Best practice for password distribution
This is only security theatre if the long-distance user does not build up his web of trust to create a trustworthy enough connection with the local user, which generally requires some time. In other words, if the user is not already on PGP, this will not work.
Mar
28
revised Best practice for password distribution
added 1262 characters in body
Mar
28
comment Best practice for password distribution
@YoavAner such a channel is not as trusted as it may seem. I do not think most users have their personal website verified by a certification authority, for example. A multichannel approach may be a secure-enough solution in some cases, but in that case the multichannel approach may also be used to distribute a key, albeit that you need to use some encryption on one of the two channels.