Iszi

9,238 reputation

12377

bio	website	security.stackexchange.com
	location	Florida
	age	30
visits	member for	2 years, 4 months
	seen	6 hours ago
stats	profile views	533

I'm not the droid you're looking for.

	9,238 reputation	bio	website	security.stackexchange.com	visits	member for	2 years, 4 months
12377 badges		location	Florida		seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

825 Comments

suggestions reviews revisions comments badges posts accepts all

2d	comment	Is “non-repudiation” automatically proven, given the other three tenets of info security? Where are you getting these "four tenets" from? I've always heard it as three: "CIA". CIA is not Confidentiality, Integrity, Authenticity. It's Confidentiality, Integrity, *Availability*. Authenticity & Non-Repudiation would be a sub-set of Integrity, I think.
May 17	comment	What is the difference between Key Escrow and a Recovery Agent? Strictly speaking, the "Key Escrow" isn't just something that's implemented for legal reasons. It could just be the way the company chose to implement their recovery process. Other than that, the distinction between Escrow vs. Agent is pretty accurate here.
May 14	comment	Source where you can find if a CVE has a patch or not The only reliable source for stating whether or not there is a patch, is the vendor of the affected software - and they don't always make it easy to search by CVE. There are other sites that try to aggregate this data, but I wouldn't rely upon them to definitively state that there isn't a patch.
May 9	comment	Intel How Strong is Your Password page, good advice? @AviD & Adnan It would at least help assure you that the claims regarding the site's operation are made by a relatively trustworthy source. As it is now, we cannot have any confidence that the site we're viewing is being served to us by Intel. Joe User isn't savvy enough to inspect the JavaScript, but most are at least a little familiar with how to check for SSL indicators in their browser. SSL is not (just) about encryption. Whether they should be punching their passwords in there at all or not is a bit of a different issue.
May 8	comment	Is salting a hash really as secure as common knowledge implies? @Gilles What I meant to say then is that it needs to be unique for each user, not for particular password strings.
May 8	comment	Is salting a hash really as secure as common knowledge implies? Suggestion: Change "it needs to be unique" to "it needs to be unique for each password".
May 2	comment	High-frequency noise deterrents I noticed the side-note about not knowing the effect on animals. I presume animals with higher hearing ranges than humans may detect these and perhaps be disturbed. Considering that animals are used in service to the perceptually impaired and other disabled individuals, I'm almost surprised an organization like the ADA hasn't been all over this. Another note: There are other "unintentional radiators" of these noise frequencies. CRTs (thankfully becoming rarer) are perhaps among the most notorious, but some other electronics put out a discernible high-pitch whine when in use.
Apr 30	comment	CTRL+ALT+DEL Login - Rationale behind it? Yeah, I'm still a little confused as to why Linux didn't use CTRL+ALT+DEL - Windows had to deal with the same "reboot button" issue, and they did reasonably well. Good additional detail here, though.
Apr 30	comment	Can anyone determine what kind of encryption this is? This doesn't look like encryption at all. It may be some sort of encoding, and really looks like more of a labeling/naming convention than anything else, but it's almost definitely not anything to do with cryptography whatsoever.
Apr 22	comment	“Please Enter Nth Character” without HSM Ok. Normally, I don't care about people not explaining downvotes - I've just given up on that cause. But c'mon! Nobody should be allowed to downvote Little Bear without providing solid justification!
Apr 8	comment	Is there additional security value in using passwords with words or phrases in non-English languages? 8 characters is so 1980s.
Apr 3	comment	I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help? I'd be more worried about hijacking the site & contest results than DoS, myself. Though DoSing a site at a critical point in the contest could have similarly significant impacts.
Mar 29	comment	Cellphone where I don't have to worry about location tracking @Polynomial I think D.W.'s edit changes the tone of the question enough so that it's not quite so strongly a "product recommendation" query. Sure, "suggest a model" is still in there. But with this revision it can be used more as a reference point (e.g.: "Yes, these exist - here's an example.") than as a core component of the question.
Mar 29	comment	Cellphone where I don't have to worry about location tracking Thanks for the edit, @D-W. I just couldn't bring myself to do it, but would have hated for the answers here to be wasted on a question that was doomed for closure.
Mar 29	comment	Cellphone where I don't have to worry about location tracking The first statement is not quite entirely accurate. A GPS receiver, on its own, cannot tell other systems where it is. However, a phone with a GPS receiver installed can do this by way of sending data over a cellular or Wi-Fi connection to the Internet. It may or may not be configured to do this by default but, for any Internet-connectable phone with a GPS, the capability is there. Also, the phone can know its location (and therefore be able to send it to third-parties if a data connection is present) without GPS using cell tower signals (as you've mentioned) and also Wi-Fi surveying.
Mar 29	comment	Cellphone where I don't have to worry about location tracking Don't forget phones with Wi-Fi can be location-aware without using GPS.
Mar 29	comment	Changing locks on server cabinet I hate answers like these. I want to +1 for "limit access to the datacenter" but -1 for "move sensitive servers to the cloud".
Mar 28	comment	Changing locks on server cabinet Then, as @lynks said, I would definitely recommend moving them to a different room. I wouldn't want critical production servers anywhere near an area that college students have access to - "supervised" or otherwise.
Mar 28	comment	Changing locks on server cabinet The answer to this will be different depending on what type of locks are installed on the server racks, and the manufacturer of the locks/racks. More detail will be needed to make this an answerable question. However, as @lynks points out, threat modeling is also important. Locks on the server cabinet are like picket fences - they keep the honest people honest, but do little against a determined and skilled attacker.
Mar 21	comment	How do cellphones discover wireless APs? You forgot to cover what happens when people turn off AP broadcasting "for security". Then, the phone is the one initiating the conversation: "Hey, AP! Are you around here anywhere? Hello, AP? Are you there?"