Reputation
209
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 6
Newest
 Critic
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 43 votes cast
Feb
6
comment Why did Poitras and Greenwald put their batteries in the fridge?
@gowenfawr Well a microwave is really only designed to shield you against frequencies around 2.4 GHz. Since blocking lower frequencies generally requires thicker shielding which would increase cost I doubt microwaves block cell phone frequencies (at least the 900 MHz ones) particularly well - or only as well as required for their indented use.
Feb
5
comment Why did Poitras and Greenwald put their batteries in the fridge?
@ThoriumBR People who used to work for the government themselves have mentioned quite a few things you can do in that regard so a bit premature of you to get the tinfoil out.. particularly if you're the very likely target for targeted attacks.
Jan
27
comment What person should I write a penetration test report as?
I was taught to generally use active voice in formal CS papers by my (American) professor. Checking some other papers this seems to at least be the general guidance at MIT. But then I've read enough other papers that use passive voice (and as a native German speaker I do have a tendency towards passive voice as well). I'd say as long as you're consistent you can't go too wrong there. Also one might argue that penetration tests and research papers are different enough to void any comparisons between the two.
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Todd certainly true, it was just about the comparison between the two specific methods. Still vastly better than the average password I'm sure.
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Todd The difference between the xkcd method and yours is, that yours is orders of magnitudes easier to crack. Sentences have a clear grammatical structure that vastly limits the options. Password crackers have been exploiting this for a while by now. So don't do it, but if you have to, at least introduce bad grammar (but at that point why not just stick with 4 random words?)
Nov
13
comment What will happen to older browsers if I disable SSLv3 on my webserver?
@Monkey But what if I actually knew that he noticed and just Poe'd you? ;)
Nov
12
comment What will happen to older browsers if I disable SSLv3 on my webserver?
@JonnyWizz Poe's law.
Oct
17
comment Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
@smci You never met a single sales or marketing person that used neither outlook (I guess you can get by with the browser UI or thunderbird, but still), onenote, powerpoint (ok that one I really can't believe) nor Word/Excel (that one doesn't surprise me that much with Libreoffice being a pretty good replacement)?
Sep
2
comment What is HiASLR?
@Polynomial So basically if I compile my dlls without /DYNAMICBASE and then force it on via the exe or the registry setting, I get an additional 5 bit entropy for free? How weird. Why? Backcomp seems unlikely (any dll that can handle 19bit ASLR should work with 24bit too).
Sep
2
comment What is HiASLR?
I'm wondering what is meant with Non-ASLR DLL images - why do they get more entropy than DLL images (which are presumably those which have the ASLR flag set?)?
Aug
29
comment How does a hacker know how many times a password was hashed?
@Hobbs didn't know that you couldn't do that with bcrypt - was assuming it'd be similar to PBKDF2. Yep in that case you need the additional complexity in your login process and have to store some additional information in the db, might as well be the iteration count.
Aug
28
comment How does a hacker know how many times a password was hashed?
"However, it is more difficult to up this in future than it is when storing with each separate password" - not really. I mean you want to update everybody to the higher iteration count immediately anyhow and not just whenever they change their password, so you will want to do it in one go anyhow. In the end that's just taking the hashed password and applying the hashing algorithm a few more rounds, storing the iteration count is not really useful there, but then as long as the user can create their own account also doesn't cost you anything.
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Cort Definitely. It's not the right option in every situation (and it really depends how you do it as you point out). I just find that it gets bashed way too often and for the wrong reasons, since for many practical purposes it's the best security your layman will be able to achieve.
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Paul Hardware keyloggers exist and are incredibly cheap and quick and easy to install. And that's just the easiest of many available options. Look up all the evil maid attacks. There's a reason why security 101 says if the attacker has physical access to your machine you've lost.
Jul
12
awarded  Critic
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
So what about people writing down their password in their day planners? To get access to those someone has to gain undisturbed access to the work place. If you're able to do that it's game over - it takes less time to install a keylogger (hardware not software if we want to be quick) than to find a password in a day planner. This is rule 101 of computer security: If the hardware is compromised you've lost. For most workplaces writing down passwords is a great option and probably about as safe as one can get.
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
If the only rule really is "at least 7 characters" I think we can all agree that the amount of trivial dictionary words will be exceedingly high. And since we know that one of those is about as secure as 4 random alphanumeric letters (I'm really generous there) why not accept those too? Accepting one really bad password but not the other is rather unfair. Personally I'm all for people writing down their complex passwords for online systems - generally everybody who can get that much physical access to steal one of those scraps of paper could just as easily install a keylogger anyhow.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
"ATM and TPV outside USA and UE are still missing the chip reader and even inside those countries most ATM are old and would still read only magnetic strips." - card readers using magnetic strips are pretty much unheard of in Europe. I guess that has to do with liability issues. Also I'm pretty sure I only used pin + chip in China.
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@PTwr The NSA certainly uses vast amounts ASICs with fixed hardware that can do nothing but SHA1 (or MD5,..) in parallel. If you think a GPU is fast, just imagine something several orders of magnitudes faster with rather reasonable power consumption. Proof for how easy something like this is even for normal people are all those VLSI bitcoin miners out there. SHA1 with PBKDF2 is only a bandaid there, what you really want is something like scrypt that's designed to take lots of resources.
May
28
comment Is it good practice to ban an IP address if too many login attempts are made from it?
@Roy If the initial sequence number is predictable, the whole handshake is predictable. But apparently that did get better over the years. But see here for what I meant.