14,082 reputation
953120
bio website security.stackexchange.com
location Florida
age 32
visits member for 4 years, 4 months
seen May 22 at 18:53

This is a canary message, to be removed in the case of my death. If you're reading this, I haven't died yet.

Then again, how would you know? I mean, how could I possibly delete this message after my own demise?

You know what? Just go ahead and assume I'm dead. Any posts appearing to be made by me are from an impostor who's stolen my identity post-mortem, and only further prove the fact that I am dead. After all, why would I even think to post a canary message if I was expecting to be alive to remove it anyway?

In any case, I'm still not the droid you're looking for.


May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null Unless you're hopelessly careless and sloppy, your password database is going to be the least likely source of account compromise. Much more likely is: 1. Your computer gets pwned with spyware/keylogger, in which case database or no database makes practically zero difference. 2. A service provider's system gets compromised, in which case the strength of your password is practically the only factor within your control that affects whether or not your account is compromised. 3. You find yourself dealing with an APT, specifically targeting you, and all bets are off anyway.
May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null In nearly every security breach to date, the most that's been given to consumers in response has been "free credit monitoring" for a year. Occasionally, the consumers are also granted some amount of free product/service from the affected vendor. Any consumers who are actually financially impacted would have to suffer the pain of that loss for as long as it takes for them to work through the vendor's grievance process. (And, perhaps, litigation.) Not something you want to do if the "loss" includes wipeout/closure of a bank account.
May
22
comment secure use of psexec?
This only really works if the systems are on the same domain. (Looks like your case is - just adding the comment in case future people needing this answer don't have that.) Otherwise, you'll need to send credentials (or a hash) to the target for authentication and you're back in the same boat.
May
22
comment How to decrypt email with revoked key in enigmail?
In WoT, key revocation is more about invalidating authenticity than it is removing access - i.e.: there's no logical reason why a client shouldn't be able to decrypt with a revoked key, but anyone verifying a signature (who's been notified of the key being revoked) should be seeing a big red flag.
May
21
comment HTTPS in captive portals and the Apple Captive Network Assistant
You're sending credit card info over WiFi in an airport? Ew.
May
21
comment Digital Certificate deployment: using two certs for each user?
possible duplicate of Why should one not use the same asymmetric key for encryption as they do for signing?
May
21
comment Why doesn't Facebook use HSTS
@paj28 Instead of closing, you could just provide an answer to that effect.
May
21
reviewed Close Multiple browser instances through differents openvpn
May
21
reviewed Close Wifi detection from different points
May
20
reviewed Leave Closed Web Developer's responsibility for DDoS
May
20
reviewed Close Need help with installing Godaddy SSL into AWS EC2 load balancer
May
20
reviewed Close How can I stop an IP from trying to use my mail server?
May
20
awarded  Famous Question
May
19
reviewed Close Encrypting string in JavaScript and decryption in Java
May
19
reviewed Close Is a “specially crafted web service in Perl” reason to be suspicious of security?
May
19
reviewed Close How to escape a cookie to cause split response?
May
19
reviewed Close Disadvantages of disabling RC4 in SSL/TLS
May
19
reviewed Close RADIUS with MS-CHAPv2 Explaination
May
18
comment Completely encrypting virtual machine (for free)
You can create TrueCrypt-like encrypted volumes with Bitlocker (howtogeek.com/193013/…). All you need to do is put your VMs' hard drive files in there. You can find & configure the locations of your VMs' hard drive files in the VM configuration screens.
May
15
comment Completely encrypting virtual machine (for free)
Or put the VM files in a TrueCrypt volume or similar...