268 reputation
29
bio website orthogonaltonormal.com
location Johnstown, PA
age 32
visits member for 2 years, 7 months
seen 23 hours ago
//TODO Glorious Lies

Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@James_pic either that's no longer the case or my employer's doing something to get around it. I just logged into gmail from Chrome at work and it's showing the use of the same bluecoat.myemployer.com cert that their proxy serves up for everything else it mitm's to monitor.
Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@Lernkurve your browser is encrypting it with the public key from your employer's certificate. Then your employer's network monitoring device uses the private key from the employer cert to decrypt the message (and presumably make sure you're not smuggling proprietary data out). It then uses Google's public key to re-encrypt your message and sends it to Google. The same process in reverse occurs for Google's response.
Jul
14
comment Should I get an antivirus for Ubuntu?
About a year ago I recall reading that one of the major browser vendors was cringing at the thought of hardware accelerated webGL on the Windows desktop because the drivers either didn't provide protection from abuse or the implementation was seriously buggy. I haven't heard anything about browser level mitigation or if Intel/AMD/nVidia have made any major improvements.
Jul
14
comment Social Engineering and Police Officers
I was thinking in terms of plugging it into your laptop not having the only copy there. Also, unless your camera software only used the USB drive for storage, whatever computer you stored the data on would potentially be of interest to them even if you initially showed a copy on a USB drive.
Jul
14
comment Social Engineering and Police Officers
The one thing I'd suggest adding is that the initial "did the camera see anything useful" check could have been performed on your laptop without having to go through the time involved in taking it to the station, having an IT person make sure it's clean, and then returning it to you.
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@DLeh You could always flip a coin 128 times and use that to generate and then enter a password into the storage tool manually.
Jun
23
comment Convincing my manager to use salts
@LieRyan For those reasons I think it's more likely the question is over if a legacy system should be upgraded, not about the design of a new one.
May
29
awarded  Critic
May
14
awarded  Pundit
May
7
comment Logging “password with counter” use
If you do it on the client side, it's possible for the user to disable the check and just send a false message claiming the PWs were different enough.
May
7
comment Logging “password with counter” use
Most password change dialogs require providing both your current and replacement password. Wouldn't taking advantage of that to do change analystics using the plaintext of both versions be a lot simpler than doing a bunch of hashes instead?
May
5
comment Box web application security review - legality?
+1 for your first paragraph; when I saw the question title I assumed it was specifically about the Box cloud platform: box.com
Apr
22
comment How can I create a password that says “SALT ME!” when hashed?
for an encore, what about values whose B64ed MD5 salts begin NoMD5, UsePbkdf2, or UseBCrypt?
Nov
27
comment What to do when I found a spyware that my spouse has installed?
@Stephane that would only be plausible if Green Fly's spouse had reason to suspect that Green Fly would be looking for evidence of being spied upon. Nothing in what has been posted so far would support such a conclusion.
Nov
24
answered “Diffie-Hellman Key Exchange” in plain English
Nov
14
comment Why are we still using HTTP?
@200_success Unfortunately in this case we're also going to have to wait on Android 2.x; and since new 2.x phones are reportedly still being sold in the developing world it's probably at least a few more years before obsolete systems finish aging out of the market.
Sep
16
awarded  Scholar
Sep
16
accepted Is it really true that Google knows most of the worlds wifi passwords
Sep
15
comment Is it really true that Google knows most of the worlds wifi passwords
@JoshuaBriefman spoofing mac addresses is trivial; enabling filtering wouldn't do any more good against an attacker who had your WPA password than it would against one who cracked your WEP password.
Sep
15
awarded  Student