640 reputation
47
bio website
location http://www.maths.manchester.ac.uk/~burdges/
age 38
visits member for 3 years
seen Nov 13 at 19:33

Nov
5
comment Are there any instant messaging systems that offer resistance to traffic analysis?
Yup. I'm contributing patches to it too. :P
Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
+1 for execsnoop :)
Sep
26
comment Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?
Almost nobody used ssh's ForceCommand, and you'd need to know the ForceCommand, so probably not even worth mentioning. There are however a fair number of web developers using local CGI scripts. And various tools like ownCloud, FreeNet, etc. use CGI scripts to provide a user interface. Not the average user, but still lots.
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still.
Jun
21
comment What is preventing us from sniffing the mobile phone communcation?
There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS.
Jun
9
comment Is LastPass' locally stored One-Time-Password recovery a security problem?
There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even.
Jun
8
comment Does OtR require than IM applications remember multiple keys per contact?
I'm unsure what "localized" means but the Guardian Project is obviously irrelevant. I'm asking about the OtR protocol minopret linked. I've answered it to my own satisfaction though : No. In fact, doing so correctly would complicate security procedures significantly, although that might be a worthy goal.
Jan
20
comment Can I reclaim ex employee gmail account?
Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
Jan
9
comment Testing C++ Algorithm On A Server
+1, another nice approach.
Jan
8
comment Testing C++ Algorithm On A Server
I've never seen a good one myself, googling "virtualization for security" yielded many results, but most just bullshit. I'd honestly just skim the Xen or VMWare manual, looking for what relevant options they offer, like prohibiting network, drive, etc. access.
Dec
27
comment Does HTTPS Everywhere defend me against sslsniff-like attacks?
+1, Convergence looks cool, thanks!
Dec
22
comment Are there any instant messaging systems that offer resistance to traffic analysis?
You are incorrect. You asked about encrypting message contents. I'm asking about defeating traffic analysis. OtR does nothing against traffic analysis. Tor chat does, but Tor chat isn't being actively developed. I'm asking what others exist. Just fyi, this was obviously never an "opinion" question, I just chose my word poorly.
Dec
18
comment SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding?
Do you need another rule for the ethernet device too? Isn't this just covering the loopback device?
Dec
12
comment How can I convert my encypted PGP secret key for use performing SSH authentication?
I sent them an email about this thread, maybe they'll epand upon the error message.
Dec
12
comment Can I reclaim ex employee gmail account?
All Gmail accounts are property of Google according to : news.cnet.com/2010-1036_3-5214467.html
Dec
11
comment Can too much web searching be a danger to a security professional?
+1, original image version
Dec
10
comment How can I convert my encypted PGP secret key for use performing SSH authentication?
In theory, your private key has been written onto your hard drive gpg --edit-key "$key" and .. | openpgp2ssh "$key" > ~/.ssh/id_rsa, maybe those sectors were overwritten later, but maybe not. You should ideally have created the intermediate unencrypted keys in either a ramdisk or an encrypted partition. I'd expect ordinary activity like locatedb, syslog, browser cache, etc. should whip them out soonish, just say'n.
Dec
10
comment How can I convert my encypted PGP secret key for use performing SSH authentication?
Can you point me towards this program, preferably it's source?
Dec
6
comment Is there any asymmetrically encrypted file system?
Just fyi, any data structures involved in crypto must be prohibited from swapping using mlock, Ninefingers. And the kernel could unload a crypto module whenever it wished. linux.die.net/man/2/mlock
Dec
6
comment Do any cloud storage system offer an append-only mode for buckets, directories, etc.?
Amusingly FTP provides this solution because it respects unix file permissions, including the sticky bit. lol I'd envisioned something both cryptographically secure and more cloud oriented though, like append-caps for Tahoe-LAFS.