368 reputation
29
bio website
location
age
visits member for 2 years, 8 months
seen 2 hours ago

Older than dirt. I got t-shirts older than you, kiddo.


1d
comment Can a lock picker slowly undermine the security of a deadbolt door?
A shield fixed to the door that made you have to reach up under the shield to insert a key would make picking much more difficult.
1d
comment Can a lock picker slowly undermine the security of a deadbolt door?
Among other things there is a non-trivial danger that the guy will jam the lock (break off a pick inside, etc), so I hope there are alternate ways to gain entry to the area.
Nov
8
comment Do we really need a long and complicated password for websites?
It would be interesting to see some credible analysis of how many actual exposures/penetrations are due to weak passwords, vs all the other holes in security. It's not clear that the million-customer penetrations at Target, Home Depot, et al were due in any way to weak passwords.
Nov
5
comment Do we really need a long and complicated password for websites?
I'll agree with the first part, but a password manager doesn't really solve anything.
Nov
5
comment Do we really need a long and complicated password for websites?
There is no good answer. Unfortunately, random passwords (eg, "pl3sqzjwAb") tend to be hard to remember and type. Most people would probably be happier with "pass phrases", but many sites will not allow them, for various reasons, good and bad.
Nov
4
comment Is blocking a country's access to a website a good measure to avoid hackers from that country?
This could be a (botched) attempt by the Venezuelan powers that be to implement a "Great Firewall of China" type thing. (Though more likely that someone didn't pay the rent on the trunk line or some such.)
Oct
30
comment Why are drives overwritten three times when being disposed of?
I think several studies have shown that a single overwrite, if it is complete, is sufficient to protect against anyone other than the NSA. And doing further overwrites adds little.
Oct
28
comment Sequential password updates
Allow "pass phrases" of arbitrary length and users will be less inclined to play games with the sequentially modified passwords.
Oct
25
comment Is it even possible to hack a television channel?
I'm pretty sure they did it on Mission Impossible once.
Oct
16
comment What is your way to create good passwords that can actually be remembered?
My "cheat", to generate apparently complex passwords that are easily remembered, is to start at one key and move diagonally. Eg, 1qazSE$rfv. You can change how you shift, do zig-zags, etc. Just avoid horizontal runs, since keyboard complexity rating algorithms sniff out those and reject them.
Oct
16
comment How to explain to a customer that spamfilters don't catch everything
There are some spam filters that are exceptionally good. The filter on the ieee.org mail forwarding service lets remarkably little spam through, but has only very rarely appeared to reject legitimate mail. Others I've experienced are virtually worthless -- rejecting more legitimate mail than spam.
Oct
8
comment Is it more secure to apply updates as soon as they get released?
Apply the fixes after they're stable but before any exploits occur.
Sep
24
awarded  Autobiographer
Sep
24
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
Is my password sent to Paypal? Yes, but by way of Russian hackers, so it's guaranteed safe. ;)
Jun
29
comment Can't brute force password cracking somehow be throttled?
I've run into several web sites where, after a failed attempt, each successive try takes longer and longer. But note that throttling/lockout strategies are not very robust in the face of a bot attack.
Jun
29
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
Along with everything else, keep in mind that if a baddie has a bot network they can make the attempt through multiple bots, so that no single IP address racks up too many failed attempts.
Apr
30
revised What is the point of spam like this?
added 330 characters in body
Apr
15
awarded  Commentator
Apr
15
comment Are there “secure” languages?
At one time Java sort of fit this description, but (beginning roughly with "reflections") it got to be too complex to verify as being "secure" in any non-trivial context.
Apr
7
comment Why did Java (JRE) vulnerabilities peak in 2012-2013?
My impression is that more and more ill-advised functionality is crammed into each successive release.