Reputation
59,195
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.4m people reached

Aug
31
comment What are the privacy and security implications of Windows Telemetry
Switching OS seems a bit drastic. Just disable telemetry entirely.
Aug
24
comment BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”
My bad - I somehow misread that entirely. I'll edit that in.
Aug
21
comment What is the argument for the fairly prevalent “No more than n repeating characters” password rule?
I think the line of thinking is that "Aaaaaaaa9" is a bad password, and preventing repeated characters should stop them from being used. I agree that it's a bad way to go about it though.
Aug
20
comment Is Linux spying on its users?
Of course they could. They created the distro.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
@Ulkoma Sure, but it's inconvenient to fiddle with a combination lock if you're trying to open your car. A key is just insert and twist. It can be done in the dark. It can be done with one hand. It can be done if your fine motor control isn't good.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Then you've got much bigger problems than getting into your car's unlock app. Arguably you shouldn't be driving at all if you're suffering from retrograde amnesia.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Usually poor protocol (vulnerable to sniffing or replay), poor RNG, poor crypto, poor implementation on the car side (e.g. not enforcing correct state machine) or anything in between.
Aug
20
comment Why do we still use keys to start cars? why not passwords?
Because every time a solution like this comes out, it's horribly broken, people's cars get stolen, and manufacturers have to do huge recalls.
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Not necessarily. Evil maid attacks, etc. are common threat scnearios.
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Right. But if they have physical access, they can just install a hardware keylogger, or a PCI card with memory access, or any other kind of hardware backdoor.
Jul
15
comment
@Ulkoma Absolutely not. It is an integral part of my love of Metal Gear Solid!
Jul
15
comment
@DeerHunter Kilts are acceptable, of course.
Jul
15
comment
@MikeOunsworth To me, professionalism just means wearing pants.
Jul
15
comment ASP.NET Machinekey encryption
@Levi Ah, well I shall defer to your knowledge on the matter. Weird though - I'm sure I got that description of behaviour from RE'ing the assemblies.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
@StackzOfZtuff Sorry, I conflated the two.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
"do not forget to define your own DH parameters or all DHE- ciphers are weak" - No, the ciphers are not weak. The use of shared ECDH groups is potentially problematic, and steps should be taken to generate your own parameters, but that doesn't make the cipher weak.
Jul
13
comment ASP.NET Machinekey encryption
@Levi This may depend on which version of the .NET framework you load, and whether you're looking at the desktop or web platform. The info above was derived from reverse engineering the framework assemblies, so I guess we're looking at different versions.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
Right. You can just change session.gc_maxlifetime to a larger timeout. The problem described there is that you shouldn't rely upon the PHP GC to time out your session on the server side, because it may not do so immediately after the configured time. It should never time it out before that time.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
"PHP session limit"? What session limit? The session cookie expiry can be set at any value, including forever. Besides, if the session no longer exists, they should be logged out, which is a totally different issue.
Jul
1
comment What is the difference between a hash table and a rainbow table, and how are they both used?
Simple answer: rainbow tables chain similar hashes together to save space, by not storing the prefix for every hash. (e.g. f2ca5152b0..., f2ca513a13..., and f2ca5177b8... can be stored as f2ca51 -> 52b0..., 3a13..., 77b8... since they share the same prefix).