Reputation
19,034
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
13 75 138
Impact
~925k people reached

2d
comment Does multiple numbers per button have an effect on security?
@schroeder Having all buttons smudged at approximately the same rate does reduce the value of smudges for reducing the search space. However, by cutting the total number of buttons down the search space is already dramatically reduced. The only way to reduce the impact of smudges on the search space, without reducing the overall possible key space is to make it so that each button can represent more than one value. (e.g.: Multi-Tap) However, such systems likely suffer from increased susceptibility to shoulder-surfing.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
Just did a skim of the whitepaper on WiFi OTP. I don't think it quite does what the OP is looking for here. At least, it would seem to require a separate WiFi AP dedicated to the purpose of generating OTPs. Those OTPs would then only really be useful in a "captive web portal" setup, like what's done at many hotels or on some SOHO guest networks - but those web portals would have to be custom-designed to use the WifiOTP for authentication. Of course, practically anything is possible with open-source firmware. But most people managing a SOHO network don't want to bother going that far.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
SSID hiding is just as weak as MAC filtering. Even worse, it makes you more vulnerable to an attacker who might spoof your AP while you're not near it. Personally, I do MAC filtering (along with an extraordinarily strong WPA2 PSK) but I will not hide my SSID.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
If you're going to bother with a web portal, why not just switch to RADIUS for WPA2 authentication?
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
I'm still not really clear what WiFiOTP is designed to solve here. If you assume the attacker already has the PSK, the only thing that can stand in their way (for most SOHO routers at least) is MAC filtering. And no amount of "proper integration" will help here. Unless you want to move up to enterprise-level hardware and security software, your router will have no way of telling whether someone using a certain MAC is an authorized user or an attacker.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
A bit of clarification about what networks can be shared with Wi-Fi Sense: It seems the network's PSK needs to be entered when sharing is turned on. (Per the FAQ here.) That does make it more difficult for people who receive your network info via WiFi Sense to re-share it, but it should be noted that it is still not impossible. The system still needs a way to retrieve the PSK as cleartext, so there are certainly ways for a determined user to do it for themselves.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
@drewbenn It may not be shared by default, but it still is shareable. AFAIK, any Wi-Fi network that your system has credentials for can be shared - whether that one was shared with you or entered manually. Also, Wi-Fi Sense provides practically no granularity in terms of deciding who you share your network with - you only get to pick which social platforms it's shared on.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
@NeilSmithline It is always worth noting that MAC filtering can be easily bypassed. For this scenario though, you have to ask: How likely is it that someone within the social network that is receiving your PSK will also have the skills, desire, and dedication to do the work required?
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
Whitelisting MAC addresses is actually much easier than giving out a password that gets cycled often. Once a MAC is on the whitelist and the client has your static password, you don't need to do anything more for them. Whenever you cycle a password though, you'll have to re-configure every client when they return. As @NeilSmithline mentions though, MAC filtering is indeed easily bypassable by a dedicated attacker. So the question then becomes: How likely is it that a dedicated attacker is going to be within the social network where your PSK is being shared?
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
It should be noted that MAC filtering is easily bypassable for a dedicated attacker. I'm not sure about WiFiOTP either - personally, I'd stick with old & trusty WPA2.
Apr
18
comment How can I mitigate the risk of my wifi key being shared with strangers through apps?
@drewbenn Problem with your logic is that this is exactly the problem that Wi-Fi Sense causes.
Apr
18
comment I have internet at home, need to know who visited what? Possible?
@MacEven in "only for internal use" cases, this might still be illegal. You'd be best served by consulting with a lawyer if you are doing this for business purposes, and even at home I'd still suggest you at least Google about for the laws which are applicable to your locale.
Apr
18
comment I have internet at home, need to know who visited what? Possible?
@SmokeDispenser Depending on the router's (and administrator's) capabilities, MitM may be possible with SSL/TLS connections as well. The only substantial hurdles to jump through would be installing a root cert on client devices and/or dealing with applications/users that refuse to accept the proxy's certificates.
Apr
11
comment Why is UDP port scanning slower than TCP port scanning?
I'd put a UDP joke in here, but I'd have no way of knowing if you got it.
Apr
7
comment How does someone become a man in the middle?
Answer to title Q: When your best friend has been together with your sister for awhile, these things can happen.
Apr
4
comment CSRF expiring before form submitted
This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review
Mar
17
comment Is a full name and address all that's needed for identity theft?
@LamonteCristo My point exactly. He might not have quite been "hacked", but there were numerous attempts (some successful) at identity theft with just his name and SSN being provided to the public.
Mar
17
comment Is a full name and address all that's needed for identity theft?
@LamonteCristo The world's seen that long before now. Ever heard of LifeLock?
Mar
17
comment Is a full name and address all that's needed for identity theft?
As noted in my answer, "name & address" is actually more than is needed to jump-start identity theft via public records searches. All you really need in some cases - especially if they are particularly unique - are a person's first and last name.
Mar
17
comment How to patch “keyless entry” car keys?
I'm thinking an Altoids can might be equally appropriate? Not sure if it's thick enough though. I'm personally dreading the day I get a car with passive-entry or keyless-start features. Tinfoil hat gets all kinds of tingly just thinking about it.