Reputation
63,270
Next tag badge:
1507/400 score
75/80 answers
Badges
17 155 252
Newest
 Nice Answer
Impact
~2.8m people reached

Sep
18
comment Software that encrypts the data before deleting it
Agreed. Unless you're literally planning the next 9/11, nobody is going to spend the time or money analysing your old disks. Take a hammer to it until you hear the platters smash. If you're super-paranoid, do a single-pass wipe of random data over the disk beforehand.
Sep
17
comment Software that encrypts the data before deleting it
@JoachimSauer It's only recently (in the last 5-10 years or so) become cheap enough to do that. Magnetic degaussing isn't flawless or cheap, and physical disk shredders are very expensive to buy and run too. But you're right, the current "optimal" method is indeed to buy a new disk and destroy the old one.
Sep
17
comment Securing the hardware of my computer against remote exploits
@D.W. Most of them were using hardware plugged into a particular device (e.g. via HDMI), but some could be done via remote control panels and such on media centre devices.
Sep
16
comment Securing the hardware of my computer against remote exploits
Side-note: I recently attended a talk at 44con which dealt with exactly this. Essentially it focused on attacking commodity hardware (tablets, TVs, BluRay players, etc) via various communications ports. In one case, fuzzing ethernet-over-HDMI completely bricked a TV. So, it's clearly not impossible to attack such devices.
Sep
16
comment Can't explain data from side channel attack attempt
@TomLeek I do state the caveats of the last code sample. I'm not sure I agree on the byte accesses front - last time I checked the JEDEC standard it specified only multiples of the bus width for memory fetch operations. This means that for the first byte of each block should be slower to access. I'm unsure as to the specifics of individual CPUs, but most (if not all) microcontrollers and volatile memory ICs that I've worked with have overheads for non-word-aligned single-byte memory reads.
Sep
16
comment Can't explain data from side channel attack attempt
Made a few edits to reflect what's been said in the comments.
Sep
15
comment Can I combine two of SHA-3 candidates cryptography hash functions and obtain more secure Algorithm?
@B-Con Yeah, I probably should've mentioned that H1 and H2 must be different. A hash of 0000000000000000... for every message isn't very useful!
Sep
14
comment Extremely suspicious phone call — what to do?
Yep, sounds like the fake AV call scam.
Sep
14
comment Global Blackout is a myth?
You're making highly generalised statements about a ridiculously complex political and technical scenario, with no technical or statistical analysis, and zero empirical evidence. We're downvoting your answer because it's not an answer, it's pure conjecture.
Sep
14
comment Can't explain data from side channel attack attempt
It's neither O(1) or O(n), since the time "glitches" occur on alignment and memory boundaries (L1 cache, L2 cache, etc). It's predictable, but it doesn't fit into a big-O model.
Sep
14
comment Identifying an unknown hash
It's not ASCII hex to base64, it's raw bytes to base64. The full character set is in effect.
Sep
14
comment Global Blackout is a myth?
This site isn't for political statements or conjecture. It's a Q&A site where we expect objective and well-sourced answers.
Sep
13
comment Can't explain data from side channel attack attempt
@MichaelMior The problem with your loop is that the if isn't one if, it's 3. Depending on the order it gets compiled to, and how it handles the eq variable, you might find out all sorts of juicy information from the timings.
Sep
13
comment Identifying an unknown hash
It's base64 of the binary representation of the hash, hence garbage. I just converted base64 to hex and guessed MD5 based on the fact that it's 128-bit.
Sep
13
comment Global Blackout is a myth?
-1. There's no technical analysis here. The first two sentences are inaccurate, and the rest is just FUD. The bombing scenario is highly unlikely, due to the distribution of servers across dozens of countries.
Sep
12
comment tools automating logins/hashes grabbing
There's a ton of spyware that does this. They usually go after product keys in the registry. I analysed one a couple years ago that had key extraction routines for a few hundred popular applications and games.
Sep
11
comment SSL Based Denial of Services due to Message Digest
Not really. The FIN/RST injection would do the same job.
Sep
11
comment How to check if someone is in my computer
@Gilles The question is almost exactly the same, but just for Windows instead. The same principle applies.
Sep
11
comment If PCI DSS isn't a law, how can I be prosecuted for not being compliant?
Under what jurisdiction and circumstances?
Sep
11
comment Cloud services - A window to outsourcing illegal activities?
My point is that it doesn't matter. Both have big potentials for criminal activity - one more overt than the other. Both also have legitimate uses. The services are amoral. Focus on individual use-cases if you want to apply moral value.