2,375 reputation
11019
bio website
location
age
visits member for 2 years, 11 months
seen 10 hours ago

Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) I wrote: "Your body is not a password." it means: "Your body is not a secret string of octets that could be transmitted on a wire." You are not a string of octets, and you are not "secret". The biometric recorded image of you that the scanner compares to you is not always a "secret" (your face, your fingerprints are hardly secrets by any reasonable definition of secrecy). That biometric information can easily be captured by anyone without your knowledge. (Same for DNA, BTW.)
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." Yes, but he would have to build a replica of you matching this "stream of bits". For fingerprints, this is not very difficult.
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
Again, I think you misunderstand biometrics. You are using your body to authenticate to the scanner. The scanner is authenticating you. The scanner is trusted by definition. "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." There is no "stream of byte" that can be reused. The scanner output is just "this is ddyer's body." (possibly encrypted with the scanner's key). Your body is not a password. The traditional version of a "scanner" is a guard who can recognise you (and cannot output a "stream of bits" that is your password).
Nov
25
comment Timing attacks on password hashes
@emboss "Today's hash functions are no (pseudo-) random functions." how do you define "(pseudo-) random"?
Nov
25
comment Timing attacks on password hashes
@emboss "Collison resistance does not imply randomness per se." collision resistance is not even relevant here
Nov
25
comment Timing attacks on password hashes
@emboss "only a collision-resistant (compression) function" Hug?
Nov
25
comment Timing attacks on password hashes
"even knowing the hash and salt would not give the attacker a significant enough advantage to derive the password" I disagree. It would give the attacker a way to perform an offline, unbounded, dictionary attack on the password. This is a strong attack on weak passwords, which is the standard assumption. (If it is guaranteed that passwords are strong, you do not need either salting or bcrypt - MD5 alone would be fine.) Without hash and salt, the attacker can only do an online attack, and the server can slow it down, so that only a few hundred passwords can be tried.
Nov
25
comment Is the Kaminsky bug still a problem for sites without DNSSEC?
@Justice "But there are new experiments with non-PKI or non-CA-based trust" Are you sure that it isn't considered a PKI? To me it is more a PKI without single sources of trust (the root CA).
Nov
22
answered Is the Kaminsky bug still a problem for sites without DNSSEC?
Nov
19
comment Encouraging security researchers to disclose vulnerabilities
How pessimistic... is that your personal experience as a vulnerability reporter?
Nov
19
comment Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?
I am actually saying that a firewall hurts more than it helps when used by less-than-experts (it can cause a lot of confusion, and does not protect much, if at all). I know that this is not exactly the consensus in the security community. So I am actually suggesting to not enable the firewall in the first place.
Nov
19
answered Detected Port Scanning Attack in ESET Smart Security
Nov
19
comment Does Hash/Salted password really help when DB is compromised?
For every security measure, it is very important IMO to understand what kind of attack it is designed to neutralize - and what other kind of attacks it can do nothing against. Indeed, you have described a kind of attack that password hashing do not prevent. I think it is very important to understand that password hashing can be useful, but is not magic!
Nov
19
comment Can web sites detect whether you are using private browsing mode?
"The background research I've done." +1 The question itself is worth reading. Thank you.
Nov
19
comment Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?
"I usually am not sure which one the application uses?" Then ask for help. Ask others "which protocols/ports do xxxx uses?" or rather, ask "how do I determine which protocols/ports xxxx uses?" You cannot properly configure a firewall if you have no idea which network protocols are used.
Nov
19
comment Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
@Pacerier I have installed and tried Tor, and support Tor goal, but that's it. I do not work for the development of Tor.
Nov
18
comment What additional difficulties are present in performing ARP poisoning on a secure wireless network (WEP, WPA) vs. an insecure one?
"if there's encryption and you don't know the password, (...) you can ARP poison to get the packets sent your way." How?
Nov
17
answered Secure SSL Session from losing itself into unsecure http
Nov
16
comment What additional difficulties are present in performing ARP poisoning on a secure wireless network (WEP, WPA) vs. an insecure one?
"if there's encryption and you don't know the password, then you can't effectively pretend to be the AP, even though you can ARP poison to get the packets sent your way." How?
Nov
16
comment What is the best way of securing a website logon without SSL or preshared keys?
It depends how you use client side hashing. If you use HMAC(nonce, HMAC(salt, password)) where salt doesn't change, and nonce change every time, then the "actual" site password is HMAC(salt, password). It means that the "actual" site password is stored in clear. But it also means that this site password is not reused by the user on any other site.