Reputation
2,862
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
1 8 20
Newest
 Yearling
Impact
~79k people reached

Feb
5
reviewed No Action Needed What makes Malware so difficult to remove?
Feb
5
comment Decrypt chunks of pgp encrypted
The question would be better asked on SE.Crypto. Beside that, the fact that you write to memory does not imply that you will never be writing to disk. Paging happens.
Feb
5
answered There might be a man in the middle attack against my server
Feb
5
revised Is the following e-mail fraud technically possible?
added 70 characters in body
Feb
5
answered Is the following e-mail fraud technically possible?
Feb
5
comment Explain to non tech savvy person how to check that your connection to mybank.com is safe?
@Anders: checking for HTTPS does not really matter in that case. You will be matched with the correct URL, which hopefully is HTTPS. You do not need to check anything beyond the fact whether your credentials are filled in or not. If they are then you are on the right page (HTTPS or not, though it will be HTTPS). If you have a site which has both HTTP (on the front page for instance) and HTTPS (on thelogin page) then your match will be against https://the.bank.address/login and http://the.bank.address/login or anything else will fail to match and credentials will not be filled in.
Feb
5
answered Explain to non tech savvy person how to check that your connection to mybank.com is safe?
Jan
6
answered How to stop ip hacking?
Jan
3
revised I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK)
added 15 characters in body
Jan
3
revised I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK)
deleted 4 characters in body
Jan
2
answered I'm concerned a website I use is vulnerable - getting vulnerabilities fixed (UK)
Jan
1
revised Is there any technical security reason not to buy the cheapest SSL certificate you can find?
added 19 characters in body
Jan
1
comment Is there an equivalent of an Apple cryptochip in Android devices?
@Gilles: I updated the question, thanks for the comments.
Jan
1
revised Is there an equivalent of an Apple cryptochip in Android devices?
added 97 characters in body
Jan
1
comment Is there an equivalent of an Apple cryptochip in Android devices?
... one must go though to try decryption.
Jan
1
comment Is there an equivalent of an Apple cryptochip in Android devices?
I mean "offline" when I take the disk off the device and try to decrypt it. This is not feasible as the key is string thanks to the TEE. The "offline-online" one is when you work on the device itself because you need the TEE together with your disk (but via, say, the USB port as it was demonstrated some time ago (using a vuln)). There is also the "online" attack where you type in the PIN every time (which was also done - there is an Arduino-based device which does the typing for you). But the key problem for me is how the throttling is implemented (specifically if via a hardware part which ...
Jan
1
comment Is there an equivalent of an Apple cryptochip in Android devices?
@Gilles: On a iPhone you get an encrypted disk which is encrypted with a strong key, even if you only use a PIN. a "pure offline" attack (= trying to break the key) is not feasible, you have to go though a "offline-online attack" (=proceed though the crypto chip). This crypto chip ensures throttling which makes a PIN a good protection (otherwise you would just have at most 10k tries, which would be trivial to do). I am trying to understand how the mechanism is implemented on Android devices.
Jan
1
comment Is there an equivalent of an Apple cryptochip in Android devices?
@Gilles: I do no understand 'N/A' (Not Applicable). What is not applicable? Android devices (as you mention) may differ in how TEE is implemented but I do not know which mechanism (and its hardware implementation) handles throttling during an offline attack.
Dec
17
revised Should I enable Google Auth login by default for my users?
added 118 characters in body
Dec
17
answered How do I scan my Routers Ports?