380 reputation
212
bio website
location
age
visits member for 3 years
seen 2 days ago

2d
awarded  Notable Question
Apr
10
comment Source code as password
arstechnica.com/security/2013/10/…
Apr
10
comment Source code as password
NO! Chrysanthou had no trouble cracking the SHA1 hash that corresponded to "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1" for one simple reason. This is a fictional occult phrase from the H. P. Lovecraft short story "The Call of Cthulhu," and it was contained in this Wikipedia entry. If your source is on the internet, your password is crackable!
Apr
4
comment How would you detect an Evil Twin attack, especially in a new environment?
Use the one with the correct MAC address. Have the sign display the MAC address of the WIFI router, and verify that is the MAC address you are connecting to. If the evil access point clones the MAC address, then it will cause general network problems and neither network will work correctly. True, it's not user friendly to verify a MAC address.
Apr
1
accepted How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
Apr
1
comment How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
Ok. I was planning to use a self-signed certificate. I don't remember how postmaster@example.com got in there, but obviously it doesn't need to be a certificate authority. I don't know why they are incompatible. The keys are just numbers.
Apr
1
comment How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
@JensErat When you click the View Certificates button it brings up Windows Certificate Manager. At MattBianco, I noticed that and thought I could sign my own certificate when I got to that step.
Mar
30
comment How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
I want to send an encrypted email and check the box in Thunderbird to encrypt it. They already have my public cert as all emails are signed, so once I have their public cert (in a format Thunderbird can use), then I can encrypt it and send to them for them to read. I don't want to use OpenPGP because Thunderbird S/MIME is easier and seamless.
Mar
30
revised How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
added 442 characters in body
Mar
30
revised How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
added 166 characters in body
Mar
30
asked How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?
Mar
24
comment Should I be concerned if my website throws stack information?
The basic principle is 'the less information revealed the better'. Some people don't even display the server version.
Mar
12
comment Is sending passwords through cellphone text messages secure?
Not to the government. However, there is TextSecure play.google.com/store/apps/…. I've also created a KeePass database on a Google Drive to securely share passwords with my assistant. Of course the master password was sent insecurely :(.
Mar
9
comment Is it possible to construct a passively self-destructing message?
Yes, I asked this question 2 years ago: crypto.stackexchange.com/questions/10012/…
Mar
5
comment Technology that can survive a “Rubber-Hose attack”
KeePass generates passwords so long and complex, I could not possibly memorize all of them. I rarely even see my passwords. It does have a master password though. If he is kidnapped, he would not have access to the passwords for a specific document or site, but he could be coerced to provide the master password.
Mar
3
comment “Secure” third-party inbox
@LieRyan I added a digital signature to my mail for about a year and I'm the only one who's ever used it. I often get "I couldn't open your p7s attachment."
Nov
10
answered Have both my email address and IP been spoofed, or has someone gotten my password, or…?
Oct
16
accepted How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?
Oct
16
comment How to explain to a customer that spamfilters don't catch everything
Use a CAPTCHA based spam filter like spamarrest.com, or boxbe.com. It catches 100% of robots!
Oct
16
comment How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?
Oh... they actually linked to the typo though. Wouldn't a hacker be able to bypass the code with a little social engineering if they knew your phone number?