576 reputation
311
bio website
location France
age
visits member for 3 years, 4 months
seen yesterday

1d
revised Disadvantages of Using a VPN?
added 181 characters in body
1d
answered Disadvantages of Using a VPN?
1d
comment Is it possible to have a text message that I didn't send appear on my smart phone making it look as if I did send the text?
+1. A forensics analysis of the phone could also reveal activities as described in your answer.
Apr
16
comment Why does the user pick the password?
@PyRulez: the password entropy is a mathematical function and can be computed on the fly. This is a terrible indication of the strength of the password and your example is very good: the entropy is 84 bits (good!) but if the attacked knows how this particular password is built (the same word repeated several times) then it becomes a bad one. If the enforced rule is that it is made up of 6 words, lower case - it is very good, etc.
Apr
15
comment Why shouldn't I sign my email newsletter using an s/mime email certificate?
Related: simson.net/ref/2004/fc2005_smime_submitted.pdf
Apr
15
comment Why shouldn't I sign my email newsletter using an s/mime email certificate?
I am looking at this from the perspective of a cloud provider (say, B2B). If I have a contract and the contract says (in essence) "all emails sent from the platform will be signed" then I shut down the discussions about forged emails mentioned in my comment. On top of that (legal aspects aside), this helps to build an expectation of the format of the email and non-compliant emails are more likely to be simply dismissed by the recipients.
Apr
15
comment Why shouldn't I sign my email newsletter using an s/mime email certificate?
Could you please expand on the second comment (about not wanting to sign for legal reasons)? Specifically, wouldn't signing limit claims from the recipient: you sign something so the recipient has less possibilities to say "I received something which seemed to come from you and I clicked and I was hacked" (to which you say "I sign all my emails, this is here in the small print")
Apr
15
answered Why does the user pick the password?
Apr
14
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
@musiKk: there is hope with Let's Encrypt
Apr
13
accepted Are there standards for software disk image acquisition in forensics?
Apr
12
comment Drupal server compromised - I want to investigate the attack technique / compromise
One point to consider : even if your server did not have anything important and you are fine with leeching it in a hacked status, it might be used for malicious activities on other machines and this is you who is going to take the blame.
Apr
12
comment Generate secure one-time codes containing information
OK, but then how do you make it a user-friendly PIN (the one the customer keys in) if there is no communication between the box and the server? Is it a 9-characters string?
Apr
12
comment Generate secure one-time codes containing information
So the key must be reversible and since it has to be of a reasonable length (6 digits being some norm), which is about 14 bits. The hash will therefore be short and thus prone to collisions.
Apr
11
comment Generate secure one-time codes containing information
also: you would like to store the allowance, counter and ID (all encrypted) and still have a practical (short) key to be keyed in by the customer?
Apr
11
comment Generate secure one-time codes containing information
how do you deal with the case where someone purchases a code (counter increases), does not use it, and then purchases again (counter increases again)? - the counters on the server and the embedded device will not match.
Apr
11
answered Best way to store/retrieve sensitive key files?
Apr
11
awarded  Custodian
Apr
11
reviewed No Action Needed Custom publickey authentication
Apr
11
answered Are there standards for software disk image acquisition in forensics?
Apr
11
comment Are there standards for software disk image acquisition in forensics?
Thanks, but I am ideally looking for something more tangible, like actual cases where the evidence for a given country was taken in one of the ways (hardware / software) and was successfully presented or refuted.