399 reputation
110
bio website
location
age
visits member for 3 years, 1 month
seen 2 days ago

Apr
20
comment Are cars with keyless proximity-based entry protected against range extenders?
The paper linked in the other answer has demonstrated the attack in multiple cars, so the part of this answer that states it's not practical yet appears to be false.
Apr
20
comment Are cars with keyless proximity-based entry protected against range extenders?
That's a very good paper that addresses exactly this question. Thanks!
Apr
19
comment Are cars with keyless proximity-based entry protected against range extenders?
I'm guessing the close votes are because car entry doesn't sound like IT security. It seems very similar to me to NFC/RFID security, which appears to be on topic, but if the community disagrees, by all means close this.
Apr
18
comment What prevents people getting charged over NFC in crowded places?
I'd go for a system that requires me to simply press a button on the card while it's being processed. Just to confirm that someone is physically in possession of the card and intending to pay with it. This would preclude anyone charging me when it's in my pocket, without requiring a pin. A reasonable trade-off maybe?
Apr
15
comment What is a good algorithm for memorizing a password in a few minutes?
The way our memory works for things like that makes it impossible to remember something like this for a long time. You have to repeat it at certain intervals for it to stick. No way around it other than avoiding to have to remember something in the first place (like some answers suggest).
Apr
15
comment Why does the user pick the password?
The problem with the password manager approach is that either you only have it on your main computer, or you trust a third party with all of your passwords (at least that they have the right crypto). I've not managed to overcome the fear of letting some sync service sync my passwords to everything.
Sep
24
comment Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?
@Iszi harder than maintaining security-hole-free blacklists? As someone who has made and maintained both, I have to disagree.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
What @tylerl said, because otherwise you wouldn't be able to use the card online. Having said that, we really need to fix this, e.g. with 2FA (e.g. send a text message that requires a respone for card-not-present transactions).
May
8
comment What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?
A privacy fix would not have to break this: the Referer header could still be supplied if the destination is on the same domain.
May
7
comment What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?
For the record, this is no longer the question I asked; it's been edited and became a different question.
May
7
comment What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?
So it's a privacy concern that's trivial to address, but isn't being addressed. Why is that? Do the users of the browsers want it? Or is this feature mainly there for the benefit of those who run websites?
Apr
10
comment How to encrypt entire HDD without any password prompts?
I'll be quite happy to store the key on the system drive, which isn't encrypted. My use case is apparently the top answer to "what are good use cases of disk encryption" - so how do they do it? I agree it seems unusual, but this use case was the top answer there...
Apr
10
comment How to encrypt entire HDD without any password prompts?
The broken drive is too broken. Click of death. Doesn't mount. The data I don't care about; it was a full mirror of another drive. The manufacturer explicitly recommends I wipe any data I don't want leaked before I send it for warranty replacement.
Apr
10
comment Why wasn't heartbleed fixed before?
Keep in mind that there exist programming environments in which this type of bug (unsafe & unchecked memory access) is essentially impossible, although they suffer a performance penalty (of various significance) as a result.
Jan
25
comment Should websites be allowed to disable autocomplete on forms or fields?
Nice to have someone I might call an "insider" here. Suppose Firefox were to unilaterally throw away this option "by popular user demand", ignoring the opinions of banks. Do you reckon Firefox risks being outright blocked by banks in this case based on, say, UserAgent? (obviously circumventable, but not by non-tech users).
Apr
4
comment Are secret URLs secure over HTTPS?
Do any known browsers send HTTPS URLs to third parties, ever? For example, Firefox crash reporter, or Chrome search-as-you-type, or IE's malware protection service?
Apr
4
comment Are secret URLs secure over HTTPS?
@Timwi nor is there anything in the HTTPS protocol preventing Chrome hosting a remote desktop server and uploading all your passwords to a third party; that's not the point :)
Apr
4
comment Are secret URLs secure over HTTPS?
Related: Can URLs be sniffed when using SSL - but different; that question is about the data contained in the request, not whether the browser leaks it through other channels.
Mar
18
comment What are the security implications of people downloading addons, wrongly thinking that they are safe?
@Piskvor Yeah, those UAE prompts totally train users to ignore them. Where's the "I trust this particular program; don't warn me again unless it changes" button?...
Jul
5
comment Is this phishing or the real PayPal?
I've also seen paypal.com redirect me to paypal-business.co.uk, which gave me quite a shock a few times. It's like they're trying to look like a fake...