190 reputation
5
bio website
location Virginia
age 32
visits member for 3 years, 1 month
seen Dec 16 at 11:47

Jul
22
comment Is amazon S3 secure enough to hold personal documents?
No. Do not put a TrueCrypt volume on S3. At least not if its something you're ever going to modify; that is not secure. See sockpuppet.org/blog/2014/04/30/you-dont-want-xts
Apr
29
comment Is webRTC safe against man in the middle attacks?
Some pointers from my (failed) attempt to answer this: WebRTC appears to require DTLS. The spec apparently allows fingerprint authentication and also PKI.
Feb
27
comment Is it okay to normalize unicode passwords with NFC/NFD?
@JonasWielicki well, apparently that RFC does. The benefits to doing so are fairly obvious (e.g., can the user manage to type ² on a smartphone?) And it turns out the downside is fairly minor.
Feb
25
answered Is it okay to normalize unicode passwords with NFC/NFD?
Feb
12
comment What is the purpose of changing the default SSID?
So will the MAC address (BSSID). And that's going to be broadcast out regardless of what SSID you pick.
Nov
13
awarded  Critic
Nov
12
comment Is blocking UDP and TCP sufficient to prevent unwanted network activity?
TCP and UDP blocked? Use ICMP instead. Or SCTP. Or several other protocols.
Oct
15
comment Is the system bios and network card protected by the OS firewall?
This isn't always true. For example, many servers have IP-KVM or similar built in, and the Ethernet hardware diverts those packets before the OS ever sees them. (Some have a dedicated port, some share a port, some have an option in the BIOS to pick a port).
Jul
30
comment How do I forensically determine whether a mobile phone has been infected with a spy suite?
@DeerHunter instead of performing a probably illegal jamming, just move the phone somewhere with no cell coverage. Usually fairly easy to find a spot... Or if not, a metal box will provide one. You can put an AP there, so it still has WiFi.
Jul
30
comment Can I use the same keyboard on both my infected and non-infected computers?
One way to confirm if your keyboard could be reflashed would be to open it up and check if it contains flash memory; if it doesn't, it can't be flashed; if it does, maybe. (Microchips are generally identified by writing on top which can be looked up to see what the chip is.)
Jul
3
comment What is the safest way to close a popup window?
JavaScript can also run on the window opening, or the page loading, etc. So its seems like, if you have a security vulnerability that lets JavaScript own your machine, you've already lost.
Jun
11
comment Somebody bumped into me, next day my storage unit was burglarized
Another possibility: someone installed something like an ATM skimmer, capturing the card one of the times OP accessed the storage unit.
Jun
7
comment I'm an IT consultant. Should I discourage a client from telling me his password?
@Adnan "They can do whatever they want" includes installing a keylogger (software or hardware) to send the password to him once you type it in again. You have to trust the person fixing your laptop.
May
28
awarded  Citizen Patrol
Apr
24
comment How can I circumvent the lack of Java updates?
Do you need Java in the browser? You can disable that if you don't.
Apr
24
comment Does password-protecting a server's BIOS help in securing sensitive data?
IP KVM often allows for BIOS access w/o physical access, which means it isn't that rare for servers.
Apr
16
awarded  Teacher
Apr
16
answered What does having an internal two-tier PKI protect against?
Apr
16
comment What does having an internal two-tier PKI protect against?
@RyanRies Maybe there is something in a relevant standard saying you can't do that, but if not, there isn't really anything contradictory about that. If you (well, your CA) self-sign a statement that you're not to be trusted anymore, then you're not to be trusted. OTOH, if the person who stole the key signs a statement that you're not to be trusted anymore, then— you're not to be trusted anymore. Same thing. Anyone in control of the private key ought to be able to revoke it.
Apr
10
comment Can I determine if my computer has a key logger installed?
Further, keep in mind that a key logger need not be software. Hardware key loggers exist.