Reputation
230
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 9
Newest
 Quorum
Impact
~4k people reached

Feb
21
comment Why is my phone connection secure without a password when WiFi is not even with a password?
@nocomprende the average person isn't complaining because the average person understands little or nothing about encryption and still doesn't understand why "Pa$$w0rd" is a terrible password.
Feb
15
awarded  Quorum
Feb
15
comment How can I get someone to use PGP in emails
I approve of open source and public auditing of encryption algorithms, I'd be a fool not to, but I can assure you that nothing magically happens to make code more secure just because someone said "I know, let's make it open source". Google "Heartbleed" and think about how long the bugs that made that possible existed in open source code. You're making a huge mistake if you think that open source code is somehow magically "unbreakable". Your misunderstanding is precisely one of the reasons that open source code isn't necessarily secure.
Feb
15
comment How can I get someone to use PGP in emails
"I am open to other solutions" - that's nice. Now all you need to do is define a problem to solve. "as long as they are open source which are as you say unbreakable and invisible." Any open source solution you find that is "unbreakable and invisible" will not be "unbreakable and invisible" simply because it is open source.
Feb
7
awarded  Excavator
Feb
7
revised How do I deal with a compromised server?
Least you could do is spell my name right...
Feb
7
awarded  Critic
Feb
4
awarded  Yearling
Feb
4
answered Do technical advice sites sometimes link to malware, and if so, how should we properly research errors?
Feb
4
answered How trustworthy is Firefox?
Dec
7
comment Does an *additional* company-wide password offer any real security?
@Jason makes sense. For me, best practice is not encouraging things like the sharing of passwords and not getting in the way of people doing their jobs. So to me this approach provides an unnecessary extra step for people trying to access a resource for very little security gain and encourages the practice of sharing passwords. So not good really.
Dec
6
comment Does an *additional* company-wide password offer any real security?
it can be pretty useful for protecting company-wide webapps and stuff like that. - protecting against what? If the server is vulnerable then there's no guarantee this company wide password will ever be in play; no point having two locks on the front door if the window is wide open. This scheme as related by the OP sounds like thinking by a novice who hasn't thought of threat models or attack vectors and just thinks "if passwords are secure then more passwords must be more secure".
Oct
2
comment Is password reuse a problem if the password is very strong?
@emory absolutely. I shouldn't be at all surprised to hear this is already going on far more than we suspect.
Oct
2
awarded  Commentator
Oct
2
comment Is password reuse a problem if the password is very strong?
@volker you're right but I mentioned all 3 sites because password data from those sites was cracked. Hashing is a speed bump (often because it's badly done) not a wall.
Oct
1
revised Is password reuse a problem if the password is very strong?
added 13 characters in body
Oct
1
answered Is password reuse a problem if the password is very strong?
Jan
4
comment Is forcing users to use a strong password effective?
If this was an "optional" service (e.g. not one imposed on me by my bank, for example) then I would regard any attempt to force me to use a password selected by the provider to probably be an indication of cluelessness on their part, and it would almost certainly motivate me to buy whatever service I was considering your site for from another provider.
Dec
14
comment Can a neighbour who installed my router access it?
I can only agree with this: If you (@kenny) don't trust the person who sets up your router then factory reset and set it up yourself. Of course, you still have to deal with the limitations of your own knowledge, but at least it won't be malicious.
Sep
6
comment How do I deal with a compromised server?
disconnecting that PC may not be in your best interests until you understand the extent, I'd agree with this actually, though my reply was written for people who, if they have to ask for the sort of help my answer offered, probably aren't equipped to make this decision themselves, because as you know, the choice you're suggesting has to balance what the victim knows about the current situation vs. an unknown future.