Reputation
653
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 5 12
Newest
 Yearling
Impact
~32k people reached

  • 0 posts edited
  • 1 helpful flag
  • 58 votes cast
Apr
17
comment What should you do if you catch ransomware mid-operation?
I definitely did not know about the first part! That's pretty interesting. Why are encrypted file sizes not the same number of bytes as the originals though? I don't see any fundamental reason for this...
Apr
9
comment Charging someone else's cell phone in my car
What if the USB port was power-only, connected to the cigarette lighter adapter? Is there any infosec danger there? (I say infosec danger because to exclude burning up the circuitry etc.)
Mar
26
comment Can a device be TLS compliant without RSA?
@Joshua: If you believe AES is secure then then can't you just encrypt it with some portion of itself as the key to simulate a hash and then XOR its chunks together to turn it into something small? In fact it makes me wonder why people don't do that...
Mar
23
comment Implications of the proposed Burr-Feinstein senate bill?
What I don't understand is, can't other countries already pass laws like this anyway? Why should that be significantly affected by what happens in the US?
Mar
23
comment Is the save button delay in a Firefox download dialog a security feature? What does it protect?
@MikeKellogg: Not sure what to say honestly then, sorry. I've explicitly noticed it preventing focus loss so many times before that I've been surprised how well it works...
Mar
23
comment Is the save button delay in a Firefox download dialog a security feature? What does it protect?
@MikeKellogg: Interesting... was there a pause (like 1 second or more) before you pressed Enter, or was it as you were typing?
Mar
22
comment Is the save button delay in a Firefox download dialog a security feature? What does it protect?
@MikeKellogg: Weird, I've found it to be basically perfect, and been so for as long as I can remember. I don't use Windows 10. I think it's only between different apps though, so if you're expecting it to work within a single app then maybe that's why? Or, how fast do you type? Maybe the built-in delay isn't right for your typing speed? It's actually more or less impossible to steal the focus in Windows from another app unless the other app lets you (the app with the current focus must call AllowSetForegroundWindow first)... in which situations have you had trouble?
Mar
21
comment Is the save button delay in a Firefox download dialog a security feature? What does it protect?
Uhm, isn't the OS supposed to prevent against unintended focus loss? Windows's focus loss prevention seems to work perfectly; Linux's is mediocre, not sure about Mac. Wouldn't this render it moot on Windows at least?
Mar
19
comment How to implement “forgot password” functionality?
@SilverlightFox: I never understood why they don't use a random number generator to generate UUIDs. Wouldn't that ensure uniqueness?
Mar
16
comment Why aren't IMSI catchers rendered ineffective by standard MITM defenses?
@JohnDeters: Thanks!!
Mar
16
comment I'm a White Hat and I develop my own viruses. Should I report it when almost all scanners say the executable is safe?
@Petah: It doesn't reproduce, does it?
Mar
16
comment Why aren't IMSI catchers rendered ineffective by standard MITM defenses?
@JohnDeters: This was a great answer! Any chance you could point to more reading on signal strength? I never realized it was the tower that calculates it; I thought it was the phone... more reading on this would be nice although I'm not sure what exactly I'm looking for either.
Mar
12
comment What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
@Sqeaky: Even if it's open-source and secure, who's to say the hardware is doing what it's supposed to?
Mar
12
comment What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?
Also, color me stupid but I feel like it's common sense that it's harder to find security holes in software that you don't have the source code for than in one that you do... which is not meant to be used as an excuse in improper settings, but which is realistically true.
Feb
22
comment If “you can never trust the client”, then why do companies such as Valve rely solely on client-side verification?
@LieRyan: Except it kind of is money. "Items in games like Team Fortress 2 and Counter-Strike: GO can be worth a lot of real money on the secondary market, not to mention the inexplicably popular virtual trading cards floating around the Steam social network."
Feb
22
comment If “you can never trust the client”, then why do companies such as Valve rely solely on client-side verification?
What I meant was that if people lose money because of other players' cheating then they will be ticked off; it wouldn't seem very different from genuine monetary fraud for them, so anti-cheat actually does have a security role.
Feb
22
comment If “you can never trust the client”, then why do companies such as Valve rely solely on client-side verification?
I hear some people spend considerable amounts of money inside games...
Feb
14
comment Something is changing my hosts file without asking
@Jacob: What the heck! Why in the world would it do that...!! (Thanks for posting!)
Feb
12
comment Something is changing my hosts file without asking
@Jacob: What was the answer that you found quickly?
Feb
3
comment Why is leaving a passworded SSH over the internet so bad?
"As I understand it, a key is not that different from a password; it is just much, much longer and therefore harder to crack."... no, you are confusing authentication tokens with public/private keys. The entire point of a private key is that, unlike a password, it is never communicated when authenticating. There is a very fundamental difference here.