Reputation
1,363
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
6 12
Newest
 Yearling
Impact
~48k people reached

Dec
27
revised Can I prevent my ISP from accessing my network if I change my router config?
added info canadian ISP
Dec
27
answered Can I prevent my ISP from accessing my network if I change my router config?
Dec
25
awarded  Yearling
Dec
16
comment How different should passwords be?
If you're using password1, you should change it to password2... It's amazing how common the use of password1 is... Seriously, the change must be such that it can't be guessed by people who know you. And 2-3 characters is not a password change, in reality, humans have a bad habit of creating patterns and a little knowledge about them shows their habitual patterns.
Dec
13
comment How do IP addresses leak information about whether they are a home client or not?
Netblock assignment registration, whois information and reverse dns lookup, geolocation lookup. But then that's databases about IPs, not the actual IP. Though geolocation can be a scream due to dhcp assignment. Since IPV4 is getting low Qwest netblocks from a distant region can be assigned if the local pool gets low. Washington users getting Minnesota series addresses. iplocationtools.com has interesting info.
Dec
12
comment What is the community doing for supporting downgrading TLS?
Sounds like any Kazakhi internet user out there should cease and desist from using the internet for buying and selling anything. Financial information's a lot more desirable than what blogs are being read, probably a governmental five-finger discount tax is in the cards. Supporting TLS downgrade just plays right into aiding and abetting.
Dec
11
comment Why shouldn't we roll our own?
Everyone including the most experienced, mathematically well versed cryptographers can produce an encryption algorithm that they truly cannot break. And then someone else gets a look at it and finds the elephant.
Dec
8
comment Can one Bypass a Web Proxy by using the Host File?
Hosts file entries are merely DNS resolution, so heh, no...
Dec
6
comment Before an attacker attempts to exploit eval(), how would they suspect that it is being used by a target application?
Would an attacker just inject code in every string passed to the server (not just user inputs), and then check whether the app breaks in some way? Viewing the server logs pretty much says, "Yes". It's easy to hire the use of a VPS and run a scripted attack that blindly bumbles its way through a list of web servers looking for the one that failed "Server Config 101" or the web developer who didn't pay attention to security detail. In fact 4500 requests of that sort over almost a day on a single server was observed over during the day of the Paris Attack, coming from Kuala Lampur. IP block!
Dec
5
comment Isn't online anonymity compromised by any SSL connection?
Security and Anonymity are two different things. Security often depends highly on not having anonymity between the two communicating parties. It's what authentication is about.
Dec
1
comment Are Downloads from file hosting sites are 100% safe from legal issue?
Depends on your jurisdiction and what you do with the files. So many ways that this is unanswerable except by suffering direct action for flagrant misuse. You're 100% safe until you are not.
Nov
30
comment How can I help catch an email scammer who is contacting me?
As in all 5 finger discount schemes, $5 is a 100% profit margin for the receiver and they wouldn't mind getting any amount of cash, especially if the exchange rate is in their favor.
Nov
28
comment Liliane Bettencourt scam?
Maximal disbelief in unsolicited random contacts and the development of effective BS filters is a major necessity on the internet. Sometimes it has to be developed through experience which is a very rough way to learn that there are a lot of untrustworthy people and scammers out there. The word of the day is "con man", every culture has instructive stories about the "confidence trickster", they want to gain your confidence so you willingly let them steal from you. The first level of defense is to refuse to participate by direct communication... curiosity or alarm is often the baited hook.
Nov
28
comment Writing my own encryption algorithm
And always remember Schneier's rule... Anybody can create a truly amazing encryption algorithm that they cannot break. ie... peer review is necessary to prove that it actually works.
Nov
28
comment Are Telegram secret chats secure assuming MTProto isn't?
Note from the future. Telegram used a roll-your-own encryption scheme which has proven to be as safe as the typical roll-your-own encryption scheme. Several of Schneier's rules apply here, use with caution or not at all till you hear it's been fixed.
Nov
23
comment Is Telegram secure?
They did a roll-your-own on their encryption... So, no. Hilarity from the future, enjoy! Said someone who examined it, "The crypto is like being stabbed in the eye with a fork."
Nov
13
comment Why are websites obviously run for nefarious reasons not taken offline asap?
Jurisdiction. If it isn't in an area where your laws apply and there isn't an agreement with that area, nothing will be done.
Nov
10
comment Why is it possible for the root user to delete the logs?
Why you worry about logs, root can delete everything. Some account must have full control at some time in order to manage the system. That's why syslog to remote system is important if you can't trust root.
Nov
10
comment Is recursively encrypting files inside containers of increasingly stronger or equivalent algorithm encryption worth it?
Law of diminishing returns, rapidly approaches WoT.
Nov
9
comment Is Linux getting less or more secure?
One of the problems we're having in the web server world is that Linux is as secure as the person running it. DIY eCommerce on VPS is quite frightening and it's down to Aptitude Ineptitude (keeping the distro up to date), misconfiguration and failure to patch non-distribution applications.