121 reputation
6
bio website 127.0.0.1
location Sao Paulo, Brazil
age 24
visits member for 2 years, 5 months
seen Jan 21 at 22:06

A happy developer. But she's the main() reason:
Me and J├ęssica


Jan
20
comment Is Java relevant to Information Security?
I think you should go into the "jack of all trades" path here. But just having some grasp of "how to make a GUI in Visual Basic to trace the criminal's IP" (lol) doesn't cut it :P So in other words, there's a long road ahead of you.
Jan
20
comment Is Java relevant to Information Security?
+1 for the honesty at the end.
Jul
28
comment Apple FileVault — would Apple build a backdoor?
Linux is excellent for servers, Windows is excellent for gaming, Mac OS is excellent for ads. Also, you mention a self-made system is not very good, but see it from the point of view that any self-made system will not have a commercial GUI application made just to crack that (and unless you're very high-profile no one will hire a top hacker to crack your laptop's encryption scheme).
Jul
27
comment /dev/random security holes
Rooting a box and messing with /dev/random? I wouldn't even bother with such a possibility.
Jul
27
comment Apple FileVault — would Apple build a backdoor?
What?! I didn't knew those algorithms were so bad it was possible to break a macbook in less than an hour. @rofls indeed.
Mar
21
comment What to do when asked for a weak password
What you say does make sense, I guess a 10-character password has some good headroom for randomness. Plus your other points are valid too. +1
Mar
21
comment What to do when asked for a weak password
@CodeInChaos Yes, mine's pretty random already (not entirely, but quite), and I hope they don't allow multiple retries (i.e., that they block people from internet banking if someone tries thousands of passwords on their accounts, requiring re-signup or something).
Mar
21
comment What to do when asked for a weak password
I do not work for them, just have an account. They're a government-owned bank, so you can expect they don't care as much about quality. So yeah, I could tell the bank and other users that their accounts are insecure, and I plan to do that, but I don't have much hope that I'll be listened. I'll look for alternatives in the future :(
Mar
20
comment What to do when asked for a weak password
But these virtual keyboards are inside the page, so they don't send keystrokes to the browser like the OS's accessibility virtual keyboard would, so it would require a bit more of tampering, correct? (If I had to guess, their easy route would be capturing the screen's drawing events like a VNC would, instead). And indeed, being the hard target is almost like a security philosophy.
Mar
20
comment Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
@StasM I think the actual hardcore hackers will be hired by the feds instead. They arrested a bunch of teenagers, I suspect they've actually arrested a few 4chan wannabes and trumpeted victory over the group not to look so lame.
Mar
20
answered Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
Mar
20
comment Topics for SecureCoding course in C
I do not agree that everybody should stop coding in C, that's just ridiculous. The people who make very very speed-sensitive applications should write in C, and I really like it when these are assembly-optimized too. It makes the same thing your Java/.NET counterpart does, but some dozen times faster. Now, this is really the exception, so I'll +1 your answer because unless you're writing a managed framework, a graphics engine, a kernel, a video codec, or things like that, you should really consider things like a garbage collector. But C still has a vast field of uses and you can't deny it.
Mar
20
comment What to do when asked for a weak password
@ekaj I'm almost sure if I asked to speak with someone he'd listen to me, nod in agreement, and when I leave, he'll joke with collegues that a brat showed up saying their expensive "security solution" outsourced from respectable WatchamacallIT® Corporation is insecure. "Pfft, he doesn't have an idea how expensive that black box in the corner was. He's not even rich!". But leaving is still a valid option.
Mar
20
comment What to do when asked for a weak password
@Legolas you've summed up the whole discussion well and it represents part of what I think too.
Mar
20
awarded  Editor
Mar
20
revised What to do when asked for a weak password
I guess it is on topic.
Mar
20
comment What to do when asked for a weak password
I'll comment about what I plan to do, since beyond what has been said it's pretty much speculation (if a site forces weak schemes on us, we're screwed anyway). If I'm at home, since I trust my home computer, I'll just use it as normal. My password is at least a hard one to crack, even at 10 alpha-numeric characters. In a computer which is not mine, but that is trustable enough as not to have a hardware rootkit, I'd use a Linux live CD. Beyond this, I'll turn on SMS reporting of transactions (so I don't have to be checking for them periodically). Most banks support this I think (this one does).
Mar
20
awarded  Scholar
Mar
20
accepted What to do when asked for a weak password
Mar
20
comment What to do when asked for a weak password
Even though I think the average security-conscious person (such as probably everyone here) is a very hard target already, I concur banks should provide and recommend better security options. Regarding key-logging, it's probably not as easy, since most banks use virtual keyboards (but still possible). You rightly point out that the obligation of having your card at hand is the most secure of all approaches, but I really think the bank should allow users to opt-out of this, since they may find this cumbersome (so I think it's up to the user to sacrifice security for convenience). +1/accepted.