Reputation
515
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 16
Impact
~28k people reached

  • 0 posts edited
  • 0 helpful flags
  • 69 votes cast
Apr
4
awarded  Notable Question
Mar
21
comment How to patch “keyless entry” car keys?
Car manufacturers could install a GPS system into the key fob and the car, and verify they are in proximity. They might have to sign the GPS coordinates with a private/public key pair. Of course, that's also hackable.
Mar
21
answered Why would someone “double encrypt”?
Mar
18
comment How can I safely check whether an email link leads to a malicious website?
I always use unfurlr.com
Mar
12
comment What are the security implications of installing an iPhone configuration profile?
You would still have to visit a particular site that presents a bogus certificate, wouldn't you? Just because you have a new fraudulent root certificate doesn't mean everyone uses it. That site says it contains a 'web clip'. And doesn't iOS partition apps to prevent them from reading each other's data?
Mar
9
asked What are the security implications of installing an iPhone configuration profile?
Feb
13
comment Where should I store OAuth2 access tokens?
The tokens are issued by the 3rd party. There is no control over how long they are valid.
Feb
10
answered Where should I store OAuth2 access tokens?
Jan
19
awarded  Popular Question
Jan
14
comment Identifying the author(s) of a piece of malware
Don't forget about when it phones home. The IP address of the command and control server can give clues too, and possibly traced.
Dec
3
awarded  Popular Question
Dec
1
comment Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?
Yes, this is frequent with banks, brokerages, and high security companies. Bloomberg does this for issuing self-signed certs for internal sites and client certs for SSO. You should only use their internet for work-related purposes. If you need privacy, you should use your mobile phone's cell connection.
Nov
27
accepted How can an email from a Yahoo address be sent through Yahoo without authentication?
Nov
27
comment Best way to administer all my passwords
Keepass.info is the best. You can share the KDBX files on Dropbox.
Nov
16
comment Preventing registered users from sharing passwords
This was going to be my answer. You can use Google Authenticator or Authy, both free, or send a text message with a code to their cell phone (maybe not every teen has a smart phone). Don't limit to 2 devices - it's too big a hassle. Like you said, what if they upgrade? Clear cookies? Etc. Need customer support for that. Big expense.
Nov
6
comment My college is forcing me to install their SSL certificate. How to protect my privacy?
BTW There are also client certificates which allows a user to log in to a proxy or web service automatically without using a password, and are often confused with SSL certificates. Client certificates don't compromise privacy (except identification and authentication) for future traffic. Apache Docs
Aug
11
comment Why do people use IP address bans when IP addresses often change?
To change your IP address if your ISP uses sticky IPs, change the MAC address of your router.
Jul
8
awarded  Popular Question
Jul
1
answered Securely storing bank account details in database
Jun
30
comment Unsubscribe safely
There is no way. For me, if the email is legitimate, from a reasonably trustworthy source, or from known mailing system (MailChimp, ConstantContact), then I click unsubscribe. If it is pure spam, I block the sender. They already got through a CAPTCHA (SpamArrest), so I know they are at least not a bot.