Jeff Burdges

595 reputation

bio	website
	location	http://www.maths.manchester.ac.uk/~burdges/
	age	37
visits	member for	1 year, 6 months
	seen	Mar 27 at 11:49
stats	profile views	27

	595 reputation	bio	website		visits	member for	1 year, 6 months
17 badges		location	http://www.maths.manchester.ac.uk/~burdges/		seen	Mar 27 at 11:49

summary answers questions tags badges favorites bounties reputation activity

61 Actions

suggestions reviews revisions comments badges posts accepts all

Nov 6	awarded	Yearling
Jun 21	comment	What is preventing us from sniffing the mobile phone communcation? Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still.
Jun 21	comment	What is preventing us from sniffing the mobile phone communcation? There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS.
Jun 9	comment	Is LastPass' locally stored One-Time-Password recovery a security problem? There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even.
Jun 9	answered	Is LastPass' locally stored One-Time-Password recovery a security problem?
Jun 8	comment	Does OtR require than IM applications remember multiple keys per contact? I'm unsure what "localized" means but the Guardian Project is obviously irrelevant. I'm asking about the OtR protocol minopret linked. I've answered it to my own satisfaction though : No. In fact, doing so correctly would complicate security procedures significantly, although that might be a worthy goal.
Jan 20	comment	Can I reclaim ex employee gmail account? Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
Jan 14	asked	Does OtR require than IM applications remember multiple keys per contact?
Jan 9	comment	Testing C++ Algorithm On A Server +1, another nice approach.
Jan 8	comment	Testing C++ Algorithm On A Server I've never seen a good one myself, googling "virtualization for security" yielded many results, but most just bullshit. I'd honestly just skim the Xen or VMWare manual, looking for what relevant options they offer, like prohibiting network, drive, etc. access.
Jan 8	answered	Testing C++ Algorithm On A Server
Dec 27	comment	Does HTTPS Everywhere defend me against sslsniff-like attacks? +1, Convergence looks cool, thanks!
Dec 22	comment	Are there any instant messaging systems that offer resistance to traffic analysis? You are incorrect. You asked about encrypting message contents. I'm asking about defeating traffic analysis. OtR does nothing against traffic analysis. Tor chat does, but Tor chat isn't being actively developed. I'm asking what others exist. Just fyi, this was obviously never an "opinion" question, I just chose my word poorly.
Dec 21	revised	Are there any instant messaging systems that offer resistance to traffic analysis? Removed the word opinion. It wasn't an 'opinion' question in the first place, obviously. <shrug>
Dec 21	revised	Are there any instant messaging systems that offer resistance to traffic analysis? added 83 characters in body
Dec 21	asked	Are there any instant messaging systems that offer resistance to traffic analysis?
Dec 21	revised	Android for the Paranoid deleted 57 characters in body
Dec 21	answered	Android for the Paranoid
Dec 18	answered	SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding?
Dec 18	comment	SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding? Do you need another rule for the ethernet device too? Isn't this just covering the loopback device?