15,016 reputation
957122
bio website security.stackexchange.com
location Florida
age 33
visits member for 4 years, 5 months
seen 2 mins ago

This is a canary message, to be removed in the case of my death. If you're reading this, I haven't died yet.

Then again, how would you know? I mean, how could I possibly delete this message after my own demise?

You know what? Just go ahead and assume I'm dead. Any posts appearing to be made by me are from an impostor who's stolen my identity post-mortem, and only further prove the fact that I am dead. After all, why would I even think to post a canary message if I was expecting to be alive to remove it anyway?

In any case, I'm still not the droid you're looking for.


16m
comment Is there a Service to setup a Honey Pot URL to collect user IP + other data?
This is like putting a phone number in an envelope on the kitchen counter, marking that envelope "personal stuff", and then waiting for a burglar to call that number. Even if your house does get robbed, chances are they're going to be too busy taking your TV, stereo, jewelry and other stuff to even notice the envelope let alone care enough to call the number inside.
1d
comment Knowing the MAC adress of a stolen laptop
Some Wi-Fi routers retain information about devices that were recently connected. I'm not sure what a MAC address will really buy you though. Since they can be changed in software, I'm not sure it would stand up in court as a unique identifier to prove ownership. Aside from that, you could use it to locate the laptop but only if you're already in fairly close range.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
@romkyns Also note: While LastPass does do client-side hashing and server-side hashing, this is probably not common among other services. I've checked some other major service providers (though not password managers) and seen them send the password with no hash.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
@romkyns According to this Ars article there's 5,000 rounds of hashing done client-side and then 100,000 server-side. One commenter quipped: PBKDF2(HMAC-SHA256, sha256(PBKDF2(HMAC-SHA256, password, salt, rounds)), salt, 100000) Ain't nobody got time for that.
Jun
16
comment Lastpass hack - risks for abuse
Do we know if the client-side hashing salt is the same as the server-side hashing salt?
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
@romkyns Even if you're sending an un-hashed password, LastPass still wouldn't (or shouldn't) know it. That is, not in any permanent sense. The server would only retain it in memory long enough to hash it before storing it, or comparing it against the stored hash. What you suggest (client-side hash, plus server-side hash before storing/comparing) is certainly possible. You can use web debuggers like Firebug or Fiddler (with SSL intercept enabled) to verify if you like.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
@romkyns Ah. That's a little unclear in your question. If an un-cracked hash is enough to access an account, then there's really no point in hashing the password to begin with. The only case where an un-cracked hash would be a concern is if the application hashes the passwords client-side before performing authentication. I don't think LastPass has specified that they don't do this, but it would be woefully incompetent of them if they did.
Jun
11
comment Is it safe to put my own router in my neighbour's DMZ?
You'd have to block access from your neighbor's IP range and block access from (and track) your own public IP. I'm pretty sure there's really no good way to do that.
Jun
11
comment Why do we keep our keys secret, rather than our algorithms?
This question isn't so much about the specific algorithm proposed, as it is about the general concept of key secrecy vs. algorithm secrecy. To answer more appropriately, you should assume the algorithm is reasonably secure (or provide argument for why all algorithms developed in secret cannot be considered reasonably secure) and work from there.
Jun
5
comment Firewall philosophy
@schroeder I think you're both more or less covering the same territory here. The key is that "Step 2" needs to be continued even after this process has fully completed once - just at a different level. The whitelist, once established, will kill most undesirable traffic by default and therefore substantially reduces both risk and long-term management overhead. However, traffic allowed through the firewall still needs to be examined for abnormalities so that the organization can detect and appropriately respond when more advanced threats do make it through.
May
26
comment How did my network admin identify my iPhone and how can I hide my ID?
@Pacerier If you're causing enough disruption, it's far from being an impossibility. I used to work in a group where we'd regularly (once every couple of months) get called out to hunt down wireless devices causing trouble with the enterprise network - with numerous buildings spread over 200+ square miles. Most of the time, these were just printers bought from the local office store, where the user didn't turn off the built-in WiFi. Seriously though, don't piss off your network admins.
May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null Unless you're hopelessly careless and sloppy, your password database is going to be the least likely source of account compromise. Much more likely is: 1. Your computer gets pwned with spyware/keylogger, in which case database or no database makes practically zero difference. 2. A service provider's system gets compromised, in which case the strength of your password is practically the only factor within your control that affects whether or not your account is compromised. 3. You find yourself dealing with an APT, specifically targeting you, and all bets are off anyway.
May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null In nearly every security breach to date, the most that's been given to consumers in response has been "free credit monitoring" for a year. Occasionally, the consumers are also granted some amount of free product/service from the affected vendor. Any consumers who are actually financially impacted would have to suffer the pain of that loss for as long as it takes for them to work through the vendor's grievance process. (And, perhaps, litigation.) Not something you want to do if the "loss" includes wipeout/closure of a bank account.
May
22
comment secure use of psexec?
This only really works if the systems are on the same domain. (Looks like your case is - just adding the comment in case future people needing this answer don't have that.) Otherwise, you'll need to send credentials (or a hash) to the target for authentication and you're back in the same boat.
May
22
comment How to decrypt email with revoked key in enigmail?
In WoT, key revocation is more about invalidating authenticity than it is removing access - i.e.: there's no logical reason why a client shouldn't be able to decrypt with a revoked key, but anyone verifying a signature (who's been notified of the key being revoked) should be seeing a big red flag.
May
21
comment HTTPS in captive portals and the Apple Captive Network Assistant
You're sending credit card info over WiFi in an airport? Ew.
May
21
comment Digital Certificate deployment: using two certs for each user?
possible duplicate of Why should one not use the same asymmetric key for encryption as they do for signing?
May
21
comment Why did Facebook not use HSTS for a long time after it became available?
@paj28 Instead of closing, you could just provide an answer to that effect.
May
18
comment Completely encrypting virtual machine (for free)
You can create TrueCrypt-like encrypted volumes with Bitlocker (howtogeek.com/193013/…). All you need to do is put your VMs' hard drive files in there. You can find & configure the locations of your VMs' hard drive files in the VM configuration screens.
May
15
comment Completely encrypting virtual machine (for free)
Or put the VM files in a TrueCrypt volume or similar...