14,067 reputation
953120
bio website security.stackexchange.com
location Florida
age 32
visits member for 4 years, 4 months
seen 2 days ago

This is a canary message, to be removed in the case of my death. If you're reading this, I haven't died yet.

Then again, how would you know? I mean, how could I possibly delete this message after my own demise?

You know what? Just go ahead and assume I'm dead. Any posts appearing to be made by me are from an impostor who's stolen my identity post-mortem, and only further prove the fact that I am dead. After all, why would I even think to post a canary message if I was expecting to be alive to remove it anyway?

In any case, I'm still not the droid you're looking for.


2d
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null Unless you're hopelessly careless and sloppy, your password database is going to be the least likely source of account compromise. Much more likely is: 1. Your computer gets pwned with spyware/keylogger, in which case database or no database makes practically zero difference. 2. A service provider's system gets compromised, in which case the strength of your password is practically the only factor within your control that affects whether or not your account is compromised. 3. You find yourself dealing with an APT, specifically targeting you, and all bets are off anyway.
2d
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Null In nearly every security breach to date, the most that's been given to consumers in response has been "free credit monitoring" for a year. Occasionally, the consumers are also granted some amount of free product/service from the affected vendor. Any consumers who are actually financially impacted would have to suffer the pain of that loss for as long as it takes for them to work through the vendor's grievance process. (And, perhaps, litigation.) Not something you want to do if the "loss" includes wipeout/closure of a bank account.
2d
comment secure use of psexec?
This only really works if the systems are on the same domain. (Looks like your case is - just adding the comment in case future people needing this answer don't have that.) Otherwise, you'll need to send credentials (or a hash) to the target for authentication and you're back in the same boat.
2d
comment How to decrypt email with revoked key in enigmail?
In WoT, key revocation is more about invalidating authenticity than it is removing access - i.e.: there's no logical reason why a client shouldn't be able to decrypt with a revoked key, but anyone verifying a signature (who's been notified of the key being revoked) should be seeing a big red flag.
May
21
comment HTTPS in captive portals and the Apple Captive Network Assistant
You're sending credit card info over WiFi in an airport? Ew.
May
21
comment Digital Certificate deployment: using two certs for each user?
possible duplicate of Why should one not use the same asymmetric key for encryption as they do for signing?
May
21
comment Why doesn't Facebook use HSTS
@paj28 Instead of closing, you could just provide an answer to that effect.
May
18
comment Completely encrypting virtual machine (for free)
You can create TrueCrypt-like encrypted volumes with Bitlocker (howtogeek.com/193013/…). All you need to do is put your VMs' hard drive files in there. You can find & configure the locations of your VMs' hard drive files in the VM configuration screens.
May
15
comment Completely encrypting virtual machine (for free)
Or put the VM files in a TrueCrypt volume or similar...
May
14
comment how do I find out where my sd card was used last
@Freedom The question here is where not when. And it's generally unlikely that the card will store that info itself. Metadata in the files might help though.
May
14
comment Apache server chooses TLS1.2 for all request even when TLS1.2 is disabled in IE9 / Windows7
I'm lost as to why you're trying to disable TLS 1.2? You should be killing off all versions of SSL, and preferably also TLS 1.0, instead.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
Depends on how you define "safer". From the application's standpoint, they're disclosing information that may point to weaknesses in their implementation where instead they could try to just silently sanitize the input with zero user awareness. From a user standpoint, it's best to know all requirements & limitations up-front rather than after the fact. In any case, the best UX includes notification to the user at some point - and Google's covering at least that much.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
Strictly, Google isn't telling the user "ahead of time" here - at least, the screenshot provided appears to be an error message presented after the password is entered. That said, it's still better than what many companies do. The most user-unfriendly I've seen are the ones that state what the password requirements are (if any) but don't state - and don't define in error messages - what the limitations are. You have to brute-force to guess why your password is being rejected for length or inclusion of certain characters.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
KeePass and similar are still rare enough that I'm sure this isn't a concern Google has in mind. Even then, those tools also have features which will auto-fill a form for you - largely eliminating the worry that a human will ever need to {mis-)read the password.
May
14
comment Why do inflight wifi networks display a captcha?
@André The MAC may be technically spoofable, but since you're in a confined area and operating wirelessly it's still easy to track down which device is using it during an active attack if you have the right equipment and expertise. That said, the risk generally is low enough that most airlines won't care about equipping their staff with the necessary tools or skills.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
Yes, but humans aren't (shouldn't be) storing and processing our passwords when we're setting up an account with Google's services.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
@gowenfawr A more general question on what drives password limitations may make sense, but that's equally closeable for being too broad or subjective.
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
I'm confused. How is spacing more difficult to deal with in 'foobar ' or ' foobar' than it is in 'foo bar'?
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
I'm voting to close this question as off-topic because only Google can really speak to their intentions regarding changes to their authentication systems. Absent any announcements from them on the matter, or an authoritative Google representative being permitted to address the issue on a public third-party forum, this question cannot be answered here.
May
14
comment What is the best setup to keep my email private from both attackers and government agencies?
@AntonioGarcia This is fairly common in organizations where e-mail encryption is used - internal messages are encrypted, but messages to/from the outside are not. At that point, you just need to make sure that there's nothing coming/going to/from the outside that warrants encryption.