21,957 reputation
359109
bio website stackexchange.com/users/…
location
age
visits member for 4 years, 8 months
seen 1 hour ago

Moderator♦ pro tempore on French Language, Computer Science and Software Recommendations. I'm also a unix amateur, and a developer on embedded systems with a computer science background and security leanings by trade.

Avatar picture slightly adapted from a photo by Luridiformis (Zonda Grattus).


1d
reviewed Reject covert-channel tag wiki
1d
reviewed Reject Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?
2d
reviewed Edit How do I clear cached credentials from my Windows Profile?
2d
revised How do I clear cached credentials from my Windows Profile?
edited body
Jul
29
reviewed Close OpenVPN redirect-gateway def1 bypass-dhcp not working on 3G
Jul
28
reviewed Close What security practices should I keep in mind during development?
Jul
27
reviewed Leave Open Failure analysis to avoid locking permanently online accounts
Jul
27
reviewed Close Where to search for vulnerabilities in a WordPress theme?
Jul
26
reviewed Close Books about theoretical basis in log management
Jul
25
awarded  Guru
Jul
24
comment Encryption of settings/credentials in mobile apps - what threats does this protect against?
At runtime, the app has the key to encrypt and decrypt. (Or else it has a token that lets it make use of the key, I believe that's possible in Lollipop, but the token can be used by another app if app isolation is broken.)
Jul
24
awarded  Constituent
Jul
20
comment Is it good practice to send passwords in separate emails, and why?
@JDługosz Yes, it does: the question is asked on a site about security. So I didn't bother to discuss scenarios not related to security in my answer.
Jul
20
comment Is it good practice to send passwords in separate emails, and why?
@JDługosz Yes, but that's a different scenario. This question was about an encrypted zip with an expectation of confidentiality.
Jul
18
comment Could one fit a root application in sim card
“Technically, these cards aren't supposed to contain executable code (they should contain only data)” — No, SIM cards always contain code. It's supposed to perform some crypto operations with a key that doesn't leave it. There can be applications running on a SIM, you'll find them sometimes on basic phones (feature phones and then smartphones mostly killed that).
Jul
17
comment Guessing random bit with 100% accuracy
Follow-up: what if there are N programs and the RNG returns values between 1 and N? (Solution)
Jul
17
comment Guessing random bit with 100% accuracy
This is a math question, actually. It's off-topic here, off-topic on Stack Overflow. It could be asked on Mathematics (surprisingly, I can't find it; this question shows the solution for the N-program case and asks a follow-up question) or, since it doesn't require advanced mathematics, on Puzzling (where this question asks for a non-math-heavy explanation of the N-program case).
Jul
17
comment Is it good practice to send passwords in separate emails, and why?
@MikeOunsworth Because if you delete the mail with the encrypted content, you lose the data. There's also the risk that the recipient will reply to the email with the encrypted attachment, with the password in quoted text, and then the conversation expands to other participants.
Jul
17
comment Is it good practice to send passwords in separate emails, and why?
@MikeOunsworth It protects against future compromise if you delete the email before the compromise. It's not a panacea, but at least it has some use.
Jul
17
comment Is it good practice to send passwords in separate emails, and why?
A breach in transit is not the main threat: email is typically adequately protected against that. A future compromise of one or the other mailbox is the main threat.