2,393 reputation
11120
bio website
location
age
visits member for 3 years
seen 11 hours ago

Dec
30
comment What are the security risks in enabling ipv6
"less immature" ?
Dec
30
comment What implications does IPv6 have for internet worms and script kiddies?
"trying to authenticate remote systems based on IP address" and not also checking routing headers at the same time...
Dec
29
comment Is IPv6 with NAT less secure than IPv4?
"are assigning at least /56 to end users" Free SAS assigns /60 per box (but you can only use /64 unless you use your modem instead of the box).
Dec
2
comment How is a worm different from a virus?
"Strictly speaking, a "virus" is a piece of executable code that is attached (usually prepended) to an existing program." so a boot sector virus is not a virus?
Dec
2
comment How is a worm different from a virus?
"Biologically, a virus is a piece of RNA." or DNA.
Dec
2
comment Bypassing a captive portal with tor
"Some captive portals work only by redirecting default DNS to a login portal." so the portal gives incorrect DNS answers? with a small TTL?
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
One thing that people do not understand about biometrics: your body is here, so you can be authenticated here. It only works if there is a trusted scanner where you are. It does not work remotely. It is useless for authentication on the net.
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) I wrote: "Your body is not a password." it means: "Your body is not a secret string of octets that could be transmitted on a wire." You are not a string of octets, and you are not "secret". The biometric recorded image of you that the scanner compares to you is not always a "secret" (your face, your fingerprints are hardly secrets by any reasonable definition of secrecy). That biometric information can easily be captured by anyone without your knowledge. (Same for DNA, BTW.)
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." Yes, but he would have to build a replica of you matching this "stream of bits". For fingerprints, this is not very difficult.
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
Again, I think you misunderstand biometrics. You are using your body to authenticate to the scanner. The scanner is authenticating you. The scanner is trusted by definition. "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." There is no "stream of byte" that can be reused. The scanner output is just "this is ddyer's body." (possibly encrypted with the scanner's key). Your body is not a password. The traditional version of a "scanner" is a guard who can recognise you (and cannot output a "stream of bits" that is your password).
Nov
25
comment Timing attacks on password hashes
@emboss "Today's hash functions are no (pseudo-) random functions." how do you define "(pseudo-) random"?
Nov
25
comment Timing attacks on password hashes
@emboss "Collison resistance does not imply randomness per se." collision resistance is not even relevant here
Nov
25
comment Timing attacks on password hashes
@emboss "only a collision-resistant (compression) function" Hug?
Nov
25
comment Timing attacks on password hashes
"even knowing the hash and salt would not give the attacker a significant enough advantage to derive the password" I disagree. It would give the attacker a way to perform an offline, unbounded, dictionary attack on the password. This is a strong attack on weak passwords, which is the standard assumption. (If it is guaranteed that passwords are strong, you do not need either salting or bcrypt - MD5 alone would be fine.) Without hash and salt, the attacker can only do an online attack, and the server can slow it down, so that only a few hundred passwords can be tried.
Nov
25
comment Is the Kaminsky bug still a problem for sites without DNSSEC?
@Justice "But there are new experiments with non-PKI or non-CA-based trust" Are you sure that it isn't considered a PKI? To me it is more a PKI without single sources of trust (the root CA).
Nov
22
answered Is the Kaminsky bug still a problem for sites without DNSSEC?
Nov
19
comment Encouraging security researchers to disclose vulnerabilities
How pessimistic... is that your personal experience as a vulnerability reporter?
Nov
19
comment Is opening both TCP/UDP less secured than just TCP or UDP when needed and why?
I am actually saying that a firewall hurts more than it helps when used by less-than-experts (it can cause a lot of confusion, and does not protect much, if at all). I know that this is not exactly the consensus in the security community. So I am actually suggesting to not enable the firewall in the first place.
Nov
19
answered Detected Port Scanning Attack in ESET Smart Security
Nov
19
comment Does Hash/Salted password really help when DB is compromised?
For every security measure, it is very important IMO to understand what kind of attack it is designed to neutralize - and what other kind of attacks it can do nothing against. Indeed, you have described a kind of attack that password hashing do not prevent. I think it is very important to understand that password hashing can be useful, but is not magic!