746 reputation
613
bio website orthogonaltonormal.com
location Johnstown, PA
age 33
visits member for 3 years, 8 months
seen 5 hours ago
//TODO Glorious Lies

Jul
24
awarded  Constituent
Jul
22
comment Onion routing vs crowds
If I'm following your explanation of how Crowds works; all users in it are functioning as exit points for other users traffic. That seems like a major potential risk to participants. (Based on articles I've read about why you shouldn't run a Tor exit node with your home internet connection/etc.)
Jul
20
awarded  Caucus
Jul
8
awarded  Popular Question
Jul
7
accepted Does restricting the names of computers allowed to connect to a wifi network provide any security
Jul
7
asked Does restricting the names of computers allowed to connect to a wifi network provide any security
May
11
comment Prevention measures against laptop seizure at US borders
@IanBoyd ...and you haven't gotten yourself any unwanted attention with certain TLAs over that last remark.
May
5
comment Why is Windows Explorer making external connections?
@Pacerier lots of people run Windows on airgapped computers. Not being connected to the internet doesn't cause them to belch magic smoke.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
I'm curious how many of these techniques also are able to beat tools like Process Monitor? (Thinking back to a number of blog posts by Mark Russinovich from before his company was bought by MS about how he used SysInternals tools to hunt down malware in a running OS).
Mar
3
comment How does Android L achieve strong encryption with a low entropy passphrase?
I think you should clarify that the use of indirection also means that the main storage is always protected with a strong key even if the users password is something farcically bad.
Jan
12
comment Why gpg-signed files differ every time
@Peter It's the same thing. When you sign a message, what happens is that you take a hash of the message, encrypt it with your private key, and then append it to the original message. The recipient verifies it by hashing the original message, using your public key to decrypt the hash you attached, and then comparing the two to make sure they're the same.
Jan
9
comment How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost?
A possible option 1.5 would be to regularly export new customers keys to an airgapped computer or offline backup so that even if the secure internet facing server is compromised long term customers keys wouldn't be accessible to the attacker.
Dec
17
comment Why does Windows Ship with Expired SSL Certificates?
@RyanRies seems reasonable; worst case if you do find a legacy app that needs them, you can always add the cert back.
Dec
14
comment Can a neighbour who installed my router access it?
The only thing I'd add is: Make sure you know what your routers default login is BEFORE you reset it.
Dec
7
awarded  Yearling
Nov
21
comment How do major sites prevent DDoS?
So have I. 10-15 years ago a number of kidiot botmasters were able to DDoS major sites off the net. One example: theregister.co.uk/2005/12/28/ebay_bots_ddos
Oct
31
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
The step in the cat and mouse game beyond that is hardware that has anti-tamper sensors in the enclosure and will wipe itself if they go off. Even that will probably fail against a determined attacker with deep pockets for anything in the mass market since the attacker can just keep buying more until they eventually defeat the intrusion detection system.
Oct
30
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
A strictly practical question: While you can change key storage as suggested below for new documents, how do you intend to handle anything uploaded before the change was made where only the user has a copy of the decryption key...
Oct
13
comment Putting my PGP ID/link on printed business cards
@LateralFractal we printed with ~6 modules of quiet zone vs the 4 minimum in the spec. We never experimented to see if a larger one might've helped (didn't know it was a factor before today).
Oct
13
comment Putting my PGP ID/link on printed business cards
@LateralFractal a few years ago I worked on something on Android using QR codes around v13 in size (~400 bytes); and even printed ~3.5" on a side we had trouble getting anything below a flagship level device to read them reliably. Cameras are better now; but I'm still skeptical of them being able to read that much off a business card sized code.