640 reputation
37
bio website
location http://www.maths.manchester.ac.uk/~burdges/
age 38
visits member for 2 years, 11 months
seen 4 hours ago

Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
+1 for execsnoop :)
Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
Almost nobody used ssh's ForceCommand, and you'd need to know the ForceCommand, so probably not even worth mentioning. There are however a fair number of web developers using local CGI scripts. And various tools like ownCloud, FreeNet, etc. use CGI scripts to provide a user interface. Not the average user, but still lots.
Mar
18
awarded  Necromancer
Nov
6
awarded  Yearling
Nov
6
awarded  Yearling
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still.
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS.
Jun
9
comment Is LastPass' locally stored One-Time-Password recovery a security problem?
There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even.
Jun
9
answered Is LastPass' locally stored One-Time-Password recovery a security problem?
Jun
8
comment Does OtR require than IM applications remember multiple keys per contact?
I'm unsure what "localized" means but the Guardian Project is obviously irrelevant. I'm asking about the OtR protocol minopret linked. I've answered it to my own satisfaction though : No. In fact, doing so correctly would complicate security procedures significantly, although that might be a worthy goal.
Jan
20
comment Can I reclaim ex employee gmail account?
Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
Jan
14
asked Does OtR require than IM applications remember multiple keys per contact?
Jan
9
comment Testing C++ Algorithm On A Server
+1, another nice approach.
Jan
8
comment Testing C++ Algorithm On A Server
I've never seen a good one myself, googling "virtualization for security" yielded many results, but most just bullshit. I'd honestly just skim the Xen or VMWare manual, looking for what relevant options they offer, like prohibiting network, drive, etc. access.
Jan
8
answered Testing C++ Algorithm On A Server
Dec
27
comment Does HTTPS Everywhere defend me against sslsniff-like attacks?
+1, Convergence looks cool, thanks!
Dec
22
comment Are there any instant messaging systems that offer resistance to traffic analysis?
You are incorrect. You asked about encrypting message contents. I'm asking about defeating traffic analysis. OtR does nothing against traffic analysis. Tor chat does, but Tor chat isn't being actively developed. I'm asking what others exist. Just fyi, this was obviously never an "opinion" question, I just chose my word poorly.
Dec
21
revised Are there any instant messaging systems that offer resistance to traffic analysis?
Removed the word opinion. It wasn't an 'opinion' question in the first place, obviously. <shrug>
Dec
21
revised Are there any instant messaging systems that offer resistance to traffic analysis?
added 83 characters in body
Dec
21
asked Are there any instant messaging systems that offer resistance to traffic analysis?