Reputation
809
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 13
Newest
 Yearling
Impact
~222k people reached

  • 0 posts edited
  • 2 helpful flags
  • 211 votes cast
Apr
25
comment Can an administrator see all of my info on shared, private WiFi?
xkcd.com/341
Apr
25
comment What's the down side of a dynamic numbered radial keypad?
I work in a building that uses a square grid random layout number pad to unlock some doors. It has an additional mitigation to hinder shoulder surfing. Restrictive viewing angles; at arms length the area that the number's are readable is only about 1.5-2 heads wide/tall. In some locations this is farther mitigated by angling the pad up slightly because more than a yard or two behind you the viewing cone is above head height even for a basketball player. From the outside I believe ours are designed to fail locked; for what they protect a delay to call a locksmith is acceptable tradeoff.
Apr
19
comment What should you do if you catch ransomware mid-operation?
@Ángel there's a huge difference between what you described in your answer (pulling keys from a running copy out of a ram image) and what you stated in your comment. Matching victims with one of the handful of c&c servers that've been taken down is far easier (and something a tech savvy victim could do on his own); in the common case where the keys haven't been recovered from the author and the crypto has been done right even an NSA sized cluster won't be able to factor a key out.
Apr
18
comment What should you do if you catch ransomware mid-operation?
Is c) a pure hypothetical, or are there paid AV programs that actually do so? I've always just gone with a free AV tool of some sort; but that level of potential disaster recovery is enough to make me contemplate a paid subscription. (As long as it's not limited to Enterprisy products that cost much more than a typical ransom amount anyway.)
Apr
6
comment Which topics should a security training for non-IT persons contain?
You could take a look at the us govt's basic computer security training for ideas. It's an ~2hour interactive flash program that covers basic operational security (ex don't let the random person banging on your office door in), as well as basic computer security. It's a few years old (flash based, has a phone that looks like a blackberry, etc) but gives good, if on the paranoid side, basic coverage. (Unless you've worked with it before, skip the part on protecting classified info, you won't have the vocab to understand it.) iatraining.disa.mil/eta/cyberchallenge_v3_fy15/launchPage.htm
Mar
30
comment Keylogger web application protection
@Stephane My unscientific research has shown that implementing an onscreen keyboard to be 100x more secure for sites primarily accessed via desktop browsers because your userbase will shrink to a hundredth of its previous size due to rage quitting.
Mar
24
comment Would it be plausible to write your own anti-crypto-ransomware tool?
@Chris sites like VirusTotal in addition to the legitimate benefit of letting suspicious users ask "Is this safe" allow malware authors to keep iterating on their spoof until they've defeated every scanner on the market prior to releasing a new version.
Mar
16
comment What to do if stuck with website that has poor security?
They could be storing the password encrypted instead of in plaintext; which is marginally less bad. It avoids a trivial plaintext leak from just a DB dump or SQL injection. It's still not good practice because if the server's compromised the attacker will probably be able to extract the decryption key with a bit of extra work.
Mar
6
revised Laptop Anti-Theft Measures
edited body
Jan
20
comment Why didn't OSes securely delete files right from the beginning? And why do they still not do this?
@Insane not a down voter; but if I was going to object over anything it'd be ignoring that secure delete is incompatible with a feature that ordinary users need far more often (and which is pointed out in other answers): Being able to recover something deleted by accident.
Jan
18
comment Can we drop XP from HTTPS support? If not, when?
@My1 You really should be looking at traffic logs for your own sites to determine how many of your users are on XP. However the major web statistics tracking companies, Net Market Share, and Stats Counter both attempt to give aggregate numbers for the internet as a whole. The two sites use different methodologies (the details are another question entirely), but broadly speaking NetMarketShare gives more weight to light users and those in the developing world, while StatsCounter is dominated by heavy users in the US/EU.
Jan
13
comment Reading physical memory frame previously owned by another process to read contents of its memory page
@KOLANICH If I'm reading that correctly (flow chart and next para) any page sent to a user application will have old data overwritten; the kernel may be able to see them. Free but dirty pages can either be zeroized and made available for normal allocations, used for memory mapped files (in this case the old data is overwritten by the file before it's given to the application), or used for allocations by the kernel. What happens in the latter case isn't discussed: It's possible the kernel sanitizes them itself. It's also possible that kernel level code is implicitly trusted (I hope it's not).
Jan
4
comment A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?
An attacker with a battering ram can always break my door down. Should I bother closing it when I leave my home? While basic security measures won't stop the most sophisticated attacks, attacks going after the weakest common denominator are far more common than being targeted by a hostile govt intelligence agency/etc; just as most thefts are crimes of convenience not all out attacks on your home.
Jan
1
comment Is there a secure way to transfer data outside the Internet?
Newegg shows several internal CD/DVD ROM only drives for <$20. They're niche devices, but there is some demand from customers in secure systems for whom the read only status is a feature. Depending on how paranoid you are; you might worry about if they're actually RW devices that just had the write part disabled in firmware.
Dec
14
awarded  Yearling
Dec
2
comment Why is Steam so insistent on security?
@immibis What're you finding particularly annoying with it? Aside from if you're regularly playing on several different devices or don't have a reliable internet connection, nothing I've seen it do has ever felt intrusive. Since I only need to log on when buying a game or switching computers (can only be logged on in computer at a time), I find myself having to enter a password much less frequently than I do for any of my financial accounts.
Dec
1
comment Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?
For #1, the easier option for a corporation that's doing https monitoring of some sort is just to block https traffic not using their CA from non-whitelisted domains. In my employer's case this is banking, healthcare, 'anonymous' employee surveys (but only if someone complains), and at least one major client that vocally objected to traffic to them being tampered with.
Nov
30
answered After getting doxxed, how can one protect personally identifiable information?
Nov
20
comment How safe are employee laptops in China against International corporate espionage?
I'll second @MarkHulkalo I'd recommend an old laptop from the to dispose pile, and physically destroying it on return.
Nov
12
comment Sanitize computer after Homeland Security seizure
If you're being really paranoid, I'd go with an OS less widely used than Linux on your live CD if possible. BSD at a minimum, something weirder like Haiku (a BeOS) clone would be better.