76 reputation
1
bio website
location
age
visits member for 2 years, 11 months
seen Mar 28 '13 at 22:06

Feb
10
comment Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
It would be better if they also send you a one time code before any transaction (the code being valid only for the particular transaction of course)
Aug
21
comment How to store chat conversations on my website?
Does this assume that if a user forgets their password and needs to have it reset then it is ok for them to not have access to their previous messages?
Aug
9
comment Is the Raspberry Pi vulnerable to injection beyond the SD Card?
I'm almost sure that the bootrom (the first stage bootloader) is in mask ROM but I can't find the reference now. If this is indeed the case then it is electrically not possible to modify it.
Aug
7
answered Can public keys be a security risk when performing password-less SSH logins?
Aug
6
comment Is multiple encryption a good idea?
Also, you say that it is about the implementation and not the algorithm itself but wouldn't chaining the algorithms also help with implementation errors in either of the algorithms? Because in the scenario above if there is an implementation error in either Alg1 or Alg2 and you happen to have chosen that one then your encryption fails. But if you chain them then there would have to be an implementation error in both of them or else you would be fine. Again, if the chaining itself causes a problem I think that means the the first algorithm or implementation has already failed.What am I missing?
Aug
6
comment Is multiple encryption a good idea?
I still don't understand this reasoning. You're not going to be implementing the algorithms in any of the options but you would use a crypto library. So the options are 1) Ciphertext = Enc_Alg1(Key, Plaintext) or 2) Ciphertext = Enc_Alg2(Key, Plaintext) or 3) Ciphertext = Enc_Alg2(Key2, Enc_Alg1(Key1, Plaintext)). If 3) is any way less secure than the others then there must be a failure in either the implementation of Alg1 or in Alg1 itself because in that case the attacker could simply take your ciphertext and encrypt it with Alg2 and start attacking from there.
Jul
31
comment Challenging challenge: client-side password hashing and server-side password verification
@Ramhound They can sniff encrypted traffic if they can get access to a router that carries some/most of the traffic to the server. This is not that unreasonable for governments or other entities with enough resources and is one reason why SSL should be used in the first place. And this is not related to MITM attacks or installing forged certificates, just passive sniffing and then eventually getting a key that can decrypt all of the previously captured traffic.
Jul
31
comment Challenging challenge: client-side password hashing and server-side password verification
@D.W. thanks, that is indeed a better way to address this.
Jul
16
comment Challenging challenge: client-side password hashing and server-side password verification
What about this simple attack scenario: the attacker manages to sniff all traffic going into your server for a few months and then they manage to compromise the server and copy all useful data, including the private key. Hopefully you detect the intrusion quickly and cut off their access but they still have both the encrypted traffic for the past several months and the private key used to protect that traffic. So, if hashing is being done on the server-side now they can get all plain-text passwords, which would not have been the case if you hashed on the client-side.
Nov
8
awarded  Teacher
Nov
8
answered Save private messages encrypted in database