Reputation
811
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
7 13
Newest
 Yearling
Impact
~204k people reached

  • 0 posts edited
  • 2 helpful flags
  • 204 votes cast
Jan
20
comment Why didn't OSes securely delete files right from the beginning? And why do they still not do this?
@Insane not a down voter; but if I was going to object over anything it'd be ignoring that secure delete is incompatible with a feature that ordinary users need far more often (and which is pointed out in other answers): Being able to recover something deleted by accident.
Jan
18
comment Can we drop XP from HTTPS support? If not, when?
@My1 You really should be looking at traffic logs for your own sites to determine how many of your users are on XP. However the major web statistics tracking companies, Net Market Share, and Stats Counter both attempt to give aggregate numbers for the internet as a whole. The two sites use different methodologies (the details are another question entirely), but broadly speaking NetMarketShare gives more weight to light users and those in the developing world, while StatsCounter is dominated by heavy users in the US/EU.
Jan
13
comment Reading physical memory frame previously owned by another process to read contents of its memory page
@KOLANICH If I'm reading that correctly (flow chart and next para) any page sent to a user application will have old data overwritten; the kernel may be able to see them. Free but dirty pages can either be zeroized and made available for normal allocations, used for memory mapped files (in this case the old data is overwritten by the file before it's given to the application), or used for allocations by the kernel. What happens in the latter case isn't discussed: It's possible the kernel sanitizes them itself. It's also possible that kernel level code is implicitly trusted (I hope it's not).
Jan
4
comment A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?
An attacker with a battering ram can always break my door down. Should I bother closing it when I leave my home? While basic security measures won't stop the most sophisticated attacks, attacks going after the weakest common denominator are far more common than being targeted by a hostile govt intelligence agency/etc; just as most thefts are crimes of convenience not all out attacks on your home.
Jan
1
comment Is there a secure way to transfer data outside the Internet?
Newegg shows several internal CD/DVD ROM only drives for <$20. They're niche devices, but there is some demand from customers in secure systems for whom the read only status is a feature. Depending on how paranoid you are; you might worry about if they're actually RW devices that just had the write part disabled in firmware.
Dec
14
awarded  Yearling
Dec
2
comment Why is Steam so insistent on security?
@immibis What're you finding particularly annoying with it? Aside from if you're regularly playing on several different devices or don't have a reliable internet connection, nothing I've seen it do has ever felt intrusive. Since I only need to log on when buying a game or switching computers (can only be logged on in computer at a time), I find myself having to enter a password much less frequently than I do for any of my financial accounts.
Dec
1
comment Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?
For #1, the easier option for a corporation that's doing https monitoring of some sort is just to block https traffic not using their CA from non-whitelisted domains. In my employer's case this is banking, healthcare, 'anonymous' employee surveys (but only if someone complains), and at least one major client that vocally objected to traffic to them being tampered with.
Nov
30
answered After getting doxxed, how can one protect personally identifiable information?
Nov
20
comment How safe are employee laptops in China against International corporate espionage?
I'll second @MarkHulkalo I'd recommend an old laptop from the to dispose pile, and physically destroying it on return.
Nov
12
comment Sanitize computer after Homeland Security seizure
If you're being really paranoid, I'd go with an OS less widely used than Linux on your live CD if possible. BSD at a minimum, something weirder like Haiku (a BeOS) clone would be better.
Nov
7
comment My college is forcing me to install their SSL certificate. How to protect my privacy?
@ysdx instead of just using a different browser profile and theme, I'd advise using a different browser all together for stronger differentiation and to make using the wrong one harder by accident. If you don't have a strong commitment to one browser over the other, FF instead of Chrome (or vice versa) would work. If you do, both of those browsers have multiple forks available.
Nov
6
comment Why is spreading malware.scr instead of malware.exe more common?
@HagenvonEitzen that's the opposite of what I've seen with users on extension hidden machines. Given the choice between AppName.exe and AppName.exe.config; when extensions are hidden they almost always click on the one that shows AppName.exe and get confused when they're asked what they want to use to view the xml instead of having the application launch.
Nov
4
comment My college is forcing me to install their SSL certificate. How to protect my privacy?
If it works the same way as the bluecoat monitoring system my employer uses; without their cert installed you won't be able to access any HTTPS sites that aren't white listed. It's been long enough since the last time I had to load a new cert that I don't remember if the failure mode was BC blocking the outbound request, or intercepting the handshake MITMing it and returning a result protected by the BC cert instead of the sites normal cert and triggering the invalid cert error in the browser.
Oct
19
comment Is there any way to safely examine the contents of a USB memory stick?
@PlasmaHH continuing what Chris said, normal sized USB sticks can be imaged in a reasonable amount of time over a 1.0 connection. Roughly half a day for a full 64GB stick (let it run overnight, look at it the next day), or an hour and a half for 8gb.
Oct
13
comment Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
@ypercube why do you assume they're not. If they edit a country tag in, some answers will become out of date; but if we were to limit answers to those that only cover things that are true in every jurisdiction, they'd be woefully incomplete in almost all of them. If we limited answerers to people who know the laws well in numerous jurisdictions, we'd massively reduce the number of people who can answer.
Oct
5
comment Offline Bruteforce attack against a Bitlockered Windows PC
Where/how would I find the secure USB module? I tried Googling for things like "USB TPM", but only found guides on how to set bitlocker up either using a regular USB key or using only a boottime password.
Sep
30
answered Laptop Anti-Theft Measures
Sep
22
comment What are the new security features in Windows 10?
To expand on why being fully patched is so important, the majority of the bugs exploited in attacks are generally long since patched. During July-Dec 2014 the most commonly exploited Windows vulnerability seen by MS security researchers was patched in 2010(!). The majority of vulnerabilities exploited in other software were also old flaws that anyone with a patched system would be safe from too.
Sep
22
comment How long should Windows 10 pins be?
@DavidZech that's awkwardly phrased; am I correctly reading it as saying that a compromised pin exposes all data on a single device; but not anything protected by an MS account and stored elsewhere (as would be the case if the attacker logged in by compromising the associated MS account password)? Or is everything in the MS cloud also exposed, but local files on other computers using the MS account still supposed to be safe?