296 reputation
1310
bio website not-implemented.com
location
age
visits member for 3 years, 8 months
seen Apr 24 at 15:05

Apr
24
comment Why can't you work backwards with public key to decrypt a message?
@mason: it depends on how pedantic are the details. This is analogous as mentioning the potential disturbance from cosmic rays when someone asks how to do a multiplication in C++
Apr
22
comment Why can't you work backwards with public key to decrypt a message?
Those remarks are really out of scope of the question, which is obviously a beginner question. Being lawyer-y pointing out that we haven't technically proven the existence of one-way functions when in practice they're used all the time as such, will just confuse the asker and provides no real value. So this is not "fair enough" and imo you shouldn't have edited it in.
Apr
22
comment Why don't we reward users who choose strong passwords?
It is unreasonable to ask users to remember a random password (especially one for every website). The use of password managers is rare, not easily encouragable and certainly not enforceable. This thus leads users to save or print their passwords which depending on the environment and other factors causes more problem than a "weak" password not written down.
Apr
14
awarded  Good Question
Mar
31
comment If a web site shows me what my password was changed to, is it stored as plain text?
If there is low max length it indicates that the developer does things because they sound good or because they are done in other places, without questioning whether it's a good idea. It doesn't indicate it's stored in plain text. Many high profile companies do this, including microsoft, blizzard, my bank, etc
Mar
4
comment Why is my debugger detected as a Trojan by anti-virus software?
@AyeshK: I don't doubt that. What I'm saying though is that antivirus consider all cracks as malware, whether they have it or not. This trains users to ignore the antivirus warnings (because most of the time they are false positives, hell, intentional false positives) so when they do finally come across a crack containing real malware, they will ignore the warnings because the antivirus cried wolf.
Mar
3
comment Why is my debugger detected as a Trojan by anti-virus software?
Most antivirus consider legitimate cracks, not containing any undesired software, as "generic trojans". This is presumably to discourage their use and/or simply because it's, generally speaking, a risky category of software. Still, I think it's very wrong to intentionally erroneously classify software we don't like as a trojan. I obviously can't speak for this specific case.
Feb
17
comment Why do browsers default to http: and not https: for typed in URLs?
@ps2goat: auto-redirecting from http to https is not an ideal situation. An attacker could perform a man-in-the-middle attack and not redirect, and display a phishing site instead
Sep
27
awarded  Commentator
Sep
27
comment Is there a short command to test if my server is secure against the shellshock bash bug?
I use mac os x, and it shows up as vulnerable -- but there is nothing I can do about it for the time being, right?
Sep
24
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
Excuse me but your answer is just pure speculation!! "..running screen-scraping scripts.." "..pretty fragile.. risks breaking.." What?? Yes, it may be implemented this way, it probably isn't (considering how big PayPal is) but the fact is that you don't know and I don't know. So please don't just start making up things
Jul
31
awarded  Famous Question
Jul
31
comment How can you be caught using Private VPN when there's no logs about who you are?
The VPN service I use, privateinternetaccess.com/pages/privacy-policy, claims PrivateInternetAccess.com does not collect or log any traffic or use of its Virtual Private Network ("VPN") or Proxy.
Jun
24
awarded  Notable Question
Jun
12
comment Is it legal to find bugs on a website and report them to the website's owner?
I completely agree @antony, I'm not a psychologist and yet I gave relationship advice to a friend the other day. So what? Why is anything even remotely touching a legal topic such a taboo on the internet?
Mar
12
awarded  Citizen Patrol
Feb
21
comment Does disabling right click have any impact on security?
@Shadur: Well banking websites notoriously do stupid things.. It often happens that your password must be a "PIN" which must be 4 numbers, no letters, no longer and no shorter /shrug
Jan
31
comment Generating random passwords by clicking randomly on the keyboard?
@Thomas: well, taking what I said very literally you are right, but you know what I meant ;) Let's try like this: length increases password security much more than the security decrease caused by having the password easy to remember, meaning that long easy-to-remember passwords are more secure than short difficult-to-remember passwords
Jan
30
comment Generating random passwords by clicking randomly on the keyboard?
Actually, in practice computer generated passwords are more random than people smashing their keyboards as demonstrated by the study linked in Dinu Smădu's answer.. of course seeding the random generator with user input gives one of the best randomness possible, but at this point I think we are going a bit off topic since the answer doesn't ask this
Jan
30
comment Generating random passwords by clicking randomly on the keyboard?
This is not an answer per-se so I'll post as a comment, but I think you are doing it wrong. The difficulty of guessing a password increases much more rapidly with length than with randomness. The password "Passwords that are phrases are easy to remember, and very secure -- people should use them more" is infinitely harder to guess than "s1DRyYbCDgjXE" and much much easier to memorize. So don't focus on having random passwords, focus on having long passwords. The same goes with salts.