Reputation
221
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 3
Newest
 Commentator
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 28 votes cast
Mar
27
comment Can 'cracked' product keys harm the user in any way?
@WillihamTotland If I use the key, I have the problem. I think that falls under the phrasing of the question, “does that harm anything other than the company who made the piece of software?” At some level, yes, the bits in the key are not the instructions the processor executes, those have been programmed separately. I'm not sure how useful that distinction is in practice, though.
Mar
27
comment Can 'cracked' product keys harm the user in any way?
How can you be so sure about that? Even in times before calling home, there were programs (I think I remember at least one case of a popular computer game) where the functionality of a cracked version (including known leaked keys for some future path version) would change the program's behavior (such as the game missing some necessary details to get past level 2). Weren't there windows versions that refused to install (security) updates when they thought the installation wasn't legitimate?
Mar
9
comment Is it possible to construct a passively self-destructing message?
Technically, OTP does not need a 3rd party. OTP means that you have a high-entropy (“truly random”) key as long as your message and use it only once. (That's the “OT” in “OTP”, whatever $anyone may market under the name this year.) I'm not sure what “synchronization” means in this context: As soon as you use any part of the key multiple times, the security goes out the window anyway. Sure, you can have some time-dependent starting point in a sufficiently long key, and you can require a third party to find it. That's still a form of “use-before x.x.x key escrow.”
Mar
7
comment Is it possible to construct a passively self-destructing message?
If you want to make this into an all-or-nothing switch, use some secret sharing algorithm. Once the number of good numbers goes below the threshold, the remaining ones don't tell you anything.
Mar
7
comment Is it possible to construct a passively self-destructing message?
I don't see how the OTP property figures in here. The fundamental idea rather seems to be to require a third party for decryption and that party to refuse after some time, yes?
Aug
14
awarded  Commentator
Aug
14
comment Can we trust antivirus software?
To be more precise: You cannot trust any software if you didn't check the source code. Just being able to in theory says nothing beyond giving you the tool to start the work of getting there.
Jun
27
comment SSH : Remote Host Identification Changed
If you use a password, the server you log in to needs to be sent that password in a form that it can use to check against its /etc/shadow, in whatever form it hashes passwords for that file. Since the server (assuming a standard user account installation) does not know your password in clear text, it cannot ask for some uniquely hashed version in a challenge-response way; the protocol must send the password such that the sshd sees the clear text password. Not a problem usually: ssh can do without passwords, using public keys.
May
5
comment Does Skype compromise my system (beyond the scope of calls/chats)?
I seem to remember Skype actively punches holes in your firewall. Which of course is a bad thing in itself. (Note that I'm talking about the real firewall outside your desktop computer, not some utility within the local OS misusing the term.)
May
5
comment Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?
Please add a little more information on details. As it stands, this answer does not appear credible and does not point at any particular weakness in the protocols.
Jan
24
comment Why EMV cards cannot be cloned?
@SoftwareMonkey It is good practice for a designer to assume the attacker knows the algorithms (and pick well-analyzed cryptographic algorithms and protocols) plus the communication protocol. That does not imply they actually are published, so as an attacker, you may still need to figure them out, in addition to the key itself.
Jan
4
comment Authencity of information displayed on an untrusted device
If your trusted device can read exactly what you read (OCR A?), it could just have a single LED for “signature verification successful”. But that is only useful for fixed-format messages where you can be certain the device reads exactly what you think it reads and does not, e.g., skip characters which you didn’t realize where unreadable to the device.
Jan
3
answered Authencity of information displayed on an untrusted device
Apr
10
awarded  Yearling
May
12
comment Security of GPG encryption with AES and MD5 if MD5 is broken
What is the hash use for? Signing?
May
12
answered SSH : Remote Host Identification Changed
May
11
awarded  Teacher
May
11
comment How secure is GnuPG conventional encryption (with defaults)?
The weak point will always be the password, and both use good standard algorithms, so yes, in terms of security, if everything is set up to work transparently and we only look at the off-site backups, they are equivalent. Obviously, the more convenient solution wins then, and TrueCrypt has additional protection in case your hardware is stolen. On the other hand, afaik, it doesn't encrypt individual files, meaning you can't (mis-)use your Mailbox as outlined in your question.
May
11
answered How secure is GnuPG conventional encryption (with defaults)?
Apr
14
awarded  Supporter