640 reputation
47
bio website
location http://www.maths.manchester.ac.uk/~burdges/
age 39
visits member for 3 years, 5 months
seen 2 days ago

Apr
6
asked Restrict FireFox to specific sites
Apr
4
comment Is Mumble encryption end to end?
Only old crappy SSL implementations let you decrypt the handshake with the private key. Any modern handshake should use Diffie-Hellman. A Mumble server knows the session key of course. And the serer's private key would let you MITM the handshake.
Mar
22
answered Would Axolotl Ratchet protocol be suitable for encrypting email communication?
Dec
3
answered Why must I have a “strong” password for sites like this?
Nov
6
awarded  Yearling
Nov
5
comment Are there any instant messaging systems that offer resistance to traffic analysis?
Yup. I'm contributing patches to it too. :P
Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
+1 for execsnoop :)
Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
Almost nobody used ssh's ForceCommand, and you'd need to know the ForceCommand, so probably not even worth mentioning. There are however a fair number of web developers using local CGI scripts. And various tools like ownCloud, FreeNet, etc. use CGI scripts to provide a user interface. Not the average user, but still lots.
Mar
18
awarded  Necromancer
Nov
6
awarded  Yearling
Nov
6
awarded  Yearling
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still.
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS.
Jun
9
comment Is LastPass' locally stored One-Time-Password recovery a security problem?
There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even.
Jun
9
answered Is LastPass' locally stored One-Time-Password recovery a security problem?
Jun
8
comment Does OtR require than IM applications remember multiple keys per contact?
I'm unsure what "localized" means but the Guardian Project is obviously irrelevant. I'm asking about the OtR protocol minopret linked. I've answered it to my own satisfaction though : No. In fact, doing so correctly would complicate security procedures significantly, although that might be a worthy goal.
Jan
20
comment Can I reclaim ex employee gmail account?
Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
Jan
14
asked Does OtR require than IM applications remember multiple keys per contact?
Jan
9
comment Testing C++ Algorithm On A Server
+1, another nice approach.
Jan
8
comment Testing C++ Algorithm On A Server
I've never seen a good one myself, googling "virtualization for security" yielded many results, but most just bullshit. I'd honestly just skim the Xen or VMWare manual, looking for what relevant options they offer, like prohibiting network, drive, etc. access.