5,849 reputation
31038
bio website adranos.com
location
age
visits member for 1 year, 11 months
seen Feb 13 at 14:40

@TildalWave said having a sig would encourage more people to view my profile. Also beer.


Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa there is a trade-off, as always. Now you only have to 'brute-force a subset of the password, but in reality, keyloggers are a much bigger threat, which is what this mechanism is designed to counter.
Jul
11
comment Taking password letters not whole one, is this secure?
The passwords are stored in an HSM, not in a reversible software format. See here for an explanation of why you can't do it in software alone.
Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa this is perfectly reasonable practice. The only problem here is a shoulder-surfer gets the password length. This is very common practice for bank web portals around the world.
Jul
10
answered Is + as an alternative to %20 an attack vector?
Jul
7
comment What are ports?
While you're in Austin, head to Jackalope on Trinity and 6th, order the pork-shoulder burger, thank me when you get back.
Jul
3
answered How risky is connecting to a hidden wireless network?
Jun
14
answered Does Gmail 2-factor auth increase security on smartphones?
Jun
14
comment Files deleted by some Employee . How to find what time it happened and whether done from another computer on network?
I'm curious as to why you say recovering files from an ext filesystem is harder than from NTFS?
Jun
3
answered Is it worth padding passwords?
Jun
3
comment Should I put a potentially insecure program online?
I started writing an answer but just kept thinking of more and more ways this can go wrong. Basically this is fine (in fact this kind of safe system-sharing is what Unix is designed to allow) if you have a decent sysadmin to ensure the integrity of the system. You don't have such a sysadmin, so I would advise you do this on a machine that is not part of a LAN, and is not used for anything else. And do not allow user programs to open network sockets, or you will be part of a botnet in no time :P
Jun
3
comment Why should I hash passwords?
Before doing any password hashing, please PLEASE go read this answer first.
May
31
comment Can your Windows or Linux username be exposed to websites?
Without exploiting the browser, nope. But browser exploits are rife.
May
30
awarded  Enlightened
May
29
awarded  Nice Answer
May
29
revised Can unencrypted keys & logins be kept out of program memory?
added 1 characters in body
May
29
revised Can unencrypted keys & logins be kept out of program memory?
added 1 characters in body
May
29
comment Can unencrypted keys & logins be kept out of program memory?
@Sulla not at all. If you were to design an encryption scheme that did not use the entire key at once, perhaps feeding in the key one byte at a time into an iterative algorithm, you could have a situation wherein the key is never stored in memory in its entirety. However, this is not a problem that encryption aims to solve,
May
29
answered Can unencrypted keys & logins be kept out of program memory?
May
28
comment Why can a Tor exit node decrypt data, but not the entry node?
This Answer gives a slightly different analogy. In answer to your question: Node C is able to open the red box, in which is contained the plain text 'Nasty Letter'.
May
28
comment Why can a Tor exit node decrypt data, but not the entry node?
@PeteyB TOR does not use PKI in the sense of global CAs. TOR keys and Node IPs are distributed by the TOR project. This distribution is protected by hard-coded public keys in the TOR software.