Jeff Burdges

585 reputation

bio	website
	location	http://www.maths.manchester.ac.uk/~burdges/
	age	37
visits	member for	1 year, 6 months
	seen	Mar 27 at 11:49
stats	profile views	27

	585 reputation	bio	website		visits	member for	1 year, 6 months
17 badges		location	http://www.maths.manchester.ac.uk/~burdges/		seen	Mar 27 at 11:49

summary answers questions tags badges favorites bounties reputation activity

25 Comments

suggestions reviews revisions comments badges posts accepts all

Jun 21	comment	What is preventing us from sniffing the mobile phone communcation? Oops, it appears the zrtp.org plugin works on several other platforms, probably not as user friendly, but still.
Jun 21	comment	What is preventing us from sniffing the mobile phone communcation? There isn't much preventing you from decrypting GSM/CDMA traffic, see chao-mu's answer. You need SRTP with ZRTP authentication for secured voice/video communications. Jitsi provides this for computers. Android has ZRTP via CSipSimple. See guardianproject.info/tag/zrtp and code.google.com/p/csipsimple and androidzoom.com/android_applications/zrtp ZRTP isn't likely outside Android and real computers, i.e. no ZRTP for iOS.
Jun 9	comment	Is LastPass' locally stored One-Time-Password recovery a security problem? There are sites that need security, like banks, sites that know your birthday, etc., and sites like security.SE that'll simply result in embarrassment, often people use completely different browsers even.
Jun 8	comment	Does OtR require than IM applications remember multiple keys per contact? I'm unsure what "localized" means but the Guardian Project is obviously irrelevant. I'm asking about the OtR protocol minopret linked. I've answered it to my own satisfaction though : No. In fact, doing so correctly would complicate security procedures significantly, although that might be a worthy goal.
Jan 20	comment	Can I reclaim ex employee gmail account? Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
Jan 9	comment	Testing C++ Algorithm On A Server +1, another nice approach.
Jan 8	comment	Testing C++ Algorithm On A Server I've never seen a good one myself, googling "virtualization for security" yielded many results, but most just bullshit. I'd honestly just skim the Xen or VMWare manual, looking for what relevant options they offer, like prohibiting network, drive, etc. access.
Dec 27	comment	Does HTTPS Everywhere defend me against sslsniff-like attacks? +1, Convergence looks cool, thanks!
Dec 22	comment	Are there any instant messaging systems that offer resistance to traffic analysis? You are incorrect. You asked about encrypting message contents. I'm asking about defeating traffic analysis. OtR does nothing against traffic analysis. Tor chat does, but Tor chat isn't being actively developed. I'm asking what others exist. Just fyi, this was obviously never an "opinion" question, I just chose my word poorly.
Dec 18	comment	SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding? Do you need another rule for the ethernet device too? Isn't this just covering the loopback device?
Dec 12	comment	How can I convert my encypted PGP secret key for use performing SSH authentication? I sent them an email about this thread, maybe they'll epand upon the error message.
Dec 12	comment	Can I reclaim ex employee gmail account? All Gmail accounts are property of Google according to : news.cnet.com/2010-1036_3-5214467.html
Dec 11	comment	Can too much web searching be a danger to a security professional? +1, original image version
Dec 10	comment	How can I convert my encypted PGP secret key for use performing SSH authentication? In theory, your private key has been written onto your hard drive `gpg --edit-key "$key"` and `.. \| openpgp2ssh "$key" > ~/.ssh/id_rsa`, maybe those sectors were overwritten later, but maybe not. You should ideally have created the intermediate unencrypted keys in either a ramdisk or an encrypted partition. I'd expect ordinary activity like locatedb, syslog, browser cache, etc. should whip them out soonish, just say'n.
Dec 10	comment	How can I convert my encypted PGP secret key for use performing SSH authentication? Can you point me towards this program, preferably it's source?
Dec 6	comment	Is there any asymmetrically encrypted file system? Just fyi, any data structures involved in crypto must be prohibited from swapping using mlock, Ninefingers. And the kernel could unload a crypto module whenever it wished. linux.die.net/man/2/mlock
Dec 6	comment	Do any cloud storage system offer an append-only mode for buckets, directories, etc.? Amusingly FTP provides this solution because it respects unix file permissions, including the sticky bit. lol I'd envisioned something both cryptographically secure and more cloud oriented though, like append-caps for Tahoe-LAFS.
Dec 6	comment	Is there any asymmetrically encrypted file system? Are you sure? I've never found a write-only or append-only mode in Amazon's S3. I even asked a question about that once : security.stackexchange.com/questions/9190/…
Dec 5	comment	How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores? Another argument for f-droid.org I suppose. lol
Dec 5	comment	How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores? Alright, I find that odd considering they claim to vet the stuff though.