Reputation
467
Top tag
Next privilege 500 Rep.
Access review queues
Badges
4 9
Impact
~45k people reached

Apr
10
comment Is it safe to store SSN's in Azure Cloud?
Unless the key is also uploaded to Azure, I don't see, a huge concern of its encrypted the correct way. what does the regulations for this company with regards to this type of information?
Mar
29
awarded  Autobiographer
Mar
27
comment Apple's OTA update process
The reason is to prevent attacks against iOS devices similar to the FBI case in CA. Otherwise they could in theory have downgraded the phone's OS.
Mar
25
comment How long will it take to break a salted password?
What hashing algorithm was used? Is the salt used known? Is it per user or same for all users? Unanswerable without these facts
Mar
16
comment Preditrend spam, how did they get my friend contact list?
Somebody with your address in their contact book was owned more then likely
Mar
16
comment Detecting attempts to manipulate help desk support
"What's your phone number" "it's 1-800-DOM-INOS" sounds like a lame idea. Configure the system so they themselves can use the OTP that they are required to setup when they setup Multi-Auth the first time, then don't reset anyone's password, without physical proof they are who they claim they are
Mar
16
comment How can startup companies protect their code from any intentional leakage?
If you can't determine who used TOR on your own network or burned a disk, or plugged In a USB drive you have major DLP issues
Mar
11
comment Can You Prove a Chat Happened Online?
Skype isn't P2P a and it hasn't been P2P for years.....
Mar
4
comment PCI-DSS Helping customers with a third-party booking service
Example.com is your website? Website allows guests to purchase items?
Mar
25
comment Anti-virus anonymity question
Bitdefender and Eset don't offer VPN offering. I suggest you disable the proxy feature in security programs. Given the most recent revelations they can't be trusted to implement it securely so it shouldn't be used. You are not "connecting" to anyone when you use these encrypted proxy features except yourself but they are often implemneted inocrrectly all the same.
Feb
26
comment Why does Microsoft limit password length?
@Dan - My password longer then 16 characters disagrees.
Sep
22
comment How do I hash a password in C#?
There are really only two correct ways to implement password hashing. Trying to suggest anything else, I would go as far as saying, doing so would be unethical.
Sep
22
comment How do I hash a password in C#?
This sounds not standard, bcrypt is easy enough to implement just do it 100,000 times and every year increase it by 50,000 and generate the password hashes again
Sep
13
comment Does company email can access hangouts and private emails?
@CaryBondoc - An Administrator more then likely can access your Google account associated to your company for a variety of reasons.
Apr
30
comment Can website see my payment information?
@user1880405 - Have you ever purchased something online before using a credit card?
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@week - I am not 100% sure if there is a secret token in the authenticator implementation Google uses.. I know how the physical and digital Vasco authenticators work. There is a known serial, known server time, and a secret token.
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@Raystafarian - The standard behind the Microsoft Authenticator and Google Authenticator is the same which is the reason you can use the Google Authenticator with Microsoft's online services. The point of that statement is there isn't any "secret" sauce in these authenticators except the source data ( i.e. serial of the authenticator ). This is the reason I say that that grid is more secure because if you supply a third-party with this serial they (might) have the required information to replicate your authenticator on any device they want. I believe there is a third peice..
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
The grid is noise generated. The google authenticator is based on 3 different values cand if you know all 3 you can generated ANY code at any point in time. By this very fact the grid is more secure. The phone being lost isn't a concern because the authenticator can be restored to any device.
Apr
26
comment AES Key Generation?
If thats the only source of random entropy then, of course it would generate the same key.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
@Lukas - It wasn't detected because the bug wasn't in every version of OpenSSL.