426 reputation
48
bio website
location Georgia
age 32
visits member for 3 years
seen Jun 10 at 12:42

Apr
30
comment Can website see my payment information?
@user1880405 - Have you ever purchased something online before using a credit card?
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@week - I am not 100% sure if there is a secret token in the authenticator implementation Google uses.. I know how the physical and digital Vasco authenticators work. There is a known serial, known server time, and a secret token.
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@Raystafarian - The standard behind the Microsoft Authenticator and Google Authenticator is the same which is the reason you can use the Google Authenticator with Microsoft's online services. The point of that statement is there isn't any "secret" sauce in these authenticators except the source data ( i.e. serial of the authenticator ). This is the reason I say that that grid is more secure because if you supply a third-party with this serial they (might) have the required information to replicate your authenticator on any device they want. I believe there is a third peice..
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
The grid is noise generated. The google authenticator is based on 3 different values cand if you know all 3 you can generated ANY code at any point in time. By this very fact the grid is more secure. The phone being lost isn't a concern because the authenticator can be restored to any device.
Apr
26
comment AES Key Generation?
If thats the only source of random entropy then, of course it would generate the same key.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
@Lukas - It wasn't detected because the bug wasn't in every version of OpenSSL.
Apr
11
comment Using client certificates for website authentication
There might be. What has your research shown?
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
@gowenfawr - I can't even tell what version that advisory effects and what version fixes the reported problem. I consider myself to be a smart individual, didn't realize RHS backpatched it granted, but holly cow that advisory is complete non-sense.
Apr
11
comment Should I cancel my current credit card because of heartbleed vulnerability?
I would say it depends. Most credit card companies won't hold you responsible for something like this. Your credit card would have only been compromise when you submitted the form, in most cases, what actually is stored is just an authorization token. Granted ALL traffic from the compromised certificate could be decrypted, the amount of data your talking about, would be enormous.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
Please dive deeper into the reason its useless because its not useless otherwise hundreds of thousands of very smart people wouldn't have enabled it and it wouldn't have even been developed.
Apr
11
comment Why can't we create a new SSL implementation?
The main reason? The current SSL specification standard isn't flawed. How its implemented in specific cases is flawed. There is a difference. Besides if people used Perfect Forward Secrecy this wouldn't be a problem. The big guys actually already do, except Yahoo, but Yahoo also transited everything within their network in plain text until a few months ago.
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
If you have 1.0.1e installed and versions up to 1.0.1f are vulnerable then your version is currently vulnerable. If you even THINK you are vulnerable you should update OpenSSL and revoke your certificate. You can also disable the SSL/TSL Heartbeat feature as an additional security measure
Mar
8
comment Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form?
Why would you want an a blob of encrypted data?
Mar
4
comment Are virtual keyboards themselves secure?
Why don't you just use the virtual keyboard built into Windows?
Jan
29
comment Does two-factor authentication reduce the need for a long password?
What does your security on your google account have to do with the security on another website have to do with one another? Long passwords are to avoid the brute force attack
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
@FranciscoPresencia - If either salt was known they would be able to brute force the user's password because all you did was hash it twice with two separate salts. The simplest of the passwords will be brute forced.
Jan
11
comment PC showed evidence of a phone being attached for no obvious reason. Theories on why?
I don't understand the question. This simply sounds like a phone was connected to the computer.
Jan
11
comment Using skype for an attack
@SomeNickName - You forgot to mention the fact that a malicious person having just your ip address is not a threat. They would also need to know they can compromise using a known vulnerability with software on the machine. In most cases any attack like this can be blocked by a router.
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
The compromise of either salt would lead to the ability to determine the user's password.The fact you store the hash from two separate salts won't change this fact.Your user's passwords still are vulnerable to a single brute force attack. I would say that your better off protecting the account and the contents by allowing these Facebook/Google/Microsoft protect their user's account.This allows your users to decide how best to protect their account with you. Most providers support authenticators allowing additional protection. You being compromise still keeps their ftp information protected.
Jan
3
comment I don't understand how BIPS got hacked
One should not tile out that the only true part of the story was the DDOS attack and the owners simply took the BTC. The price of BTC in Nov was a great deal more then it is today