62,172 reputation
8121316
bio website
location
age
visits member for 4 years, 6 months
seen 5 hours ago

15h
comment Is it okay if passphrases to KDFs are “predictable”
security.stackexchange.com/a/2213/971, security.stackexchange.com/a/2209/971
2d
answered Spear phishing data set
Jul
25
awarded  Announcer
Jul
25
asked Spear phishing data set
Jul
24
awarded  Constituent
Jul
24
comment Why is my internal IP address (private) visible from the Internet?
Cool! System glitch, maybe; who knows. Anyway, thanks for the link to SO; good stuff.
Jul
24
comment Why is my internal IP address (private) visible from the Internet?
This seems to have a lot of overlap with an earlier-posted answer. I wonder if the last sentence might be more useful as an edit to one of the existing answers rather than a new answer?
Jul
24
comment Does setting a default DROP policy actually improve security?
@ParthianShot, I realize that's what some people might be thinking, but nonetheless, on this site, we discourage use of "Stuff. Edit: More stuff." A large part of our mission is to build an archive of high-quality questions and answers that will be useful to future readers; "Edit: blah" is a bad pattern. See meta.stackexchange.com/q/127639/160917 and meta.stackexchange.com/q/202472/160917 and meta.stackexchange.com/q/183267/160917 for extensive discussion and reasons why you probably shouldn't use "Edit:" like that.
Jul
23
comment Does setting a default DROP policy actually improve security?
It's not clear what you are asking. Are you asking whether DROP is better than REJECT? Whether DROP is better than ACCEPT? Something else? Basically, tell us what the alternative that you want us to compare to. "improves" is inherently relative, but you haven't told us what baseline you want to compare to. I suggest editing the question to clarify explicitly. Also, don't just append "Edit: some other stuff" to the end of your question. We have revision history, so you don't need to do that -- rewrite your question to be what it should have been from the start.
Jul
22
comment Is (safe) encryption over compromised line impossible?
"B can send a hash back to A" - but the MITM can replace that, too. Again, Quantum key distribution is only secure against MITM attack if you have a separate out-of-band channel that is not subject to tampering (in which case you could just do Diffie-Hellman over that channel), or if you have some other way to authenticate the other party (e.g., a PKI). Bottom line: I think you have a fundamental misconception of the security properties that quantum key exchange provides.
Jul
21
comment Is (safe) encryption over compromised line impossible?
This answer is incorrect. Quantum key distribution is not secure against a man-in-the-middle, any more than Diffie-Hellman is. Think of it this way: if you want to be sure you're talking to Alice but you have no way to identify it's her, how are you possibly going to know whether it's Alice you're talking to or Alice-imposter? Quantum crypto isn't magic; it doesn't change this fact.
Jul
21
comment Is (safe) encryption over compromised line impossible?
@danielAzuelos, for purposes of intellectual credit, the scientific community has a long-standing tradition of giving credit to the first person to discover and publish the result. If X discovers an idea first but doesn't tell anyone about it, X doesn't get the credit in the scientific literature. There are good reasons for this: it doesn't do anyone any good if you don't tell the world about your discovery. So, our naming convention for Diffie-Hellman is consistent with standard practices in the scientific community; this is not intellectually dishonest.
Jul
20
awarded  Popular Question
Jul
20
comment Can malicious code trigger without the user executing or opening the file?
1. What's your threat model? In any threat model where you are visiting a possibly-malicious website, there are other ways that the website might be able to compromise you (e.g., by a zero-day exploit), so I'm not convinced it makes sense to focus only on downloads, and I don't think it's possible to "only download that file" (you'll also be visiting a page that could execute Javascript that could try to exploit any vulnerability in your browser). 2. What research have you done?
Jul
18
comment Double encryption with home brew algorithm
"it would still take some time for an attacker to figure out how to crack your home-brew algorithm" - There's no guarantee of that. You should see some of the homebrew algorithms that people have come up with....
Jul
17
comment What Country, State and City should I choose when requesting an SSL certificate?
@Core_dumped, (1) please don't use the comments to ask follow-up questions -- they should either be part of your original question (you can edit it) or asked as a separate question, (2) please don't spam the same comment underneath multiple answers.
Jul
16
comment Is it good practice to send passwords in separate emails, and why?
"much more difficult" - do you have any justification for that claim? I think you're over-stating the amount of security it adds to send the information separately. No, an eavesdropper would not need an AI to match two emails that were sent from the same sender to the same recipient on the same day.
Jul
16
comment Would making an IIS web server appear to be running Apache instead improve security?
What exactly is your question? You need some good arguments -- some good arguments for what? Your implicit premise seems to be that this is a bad idea. Why do you think this is a bad idea? This seems more like a workplace relationship management question than a technical question. Your CEO suggests doing something that probably won't offer any benefit but also won't do any harm, and that's easy to implement. What should you do? Tell your CEO answer "sure, I can do that", spend 5 minutes to implement it, and move on. Everyone walks away happy.
Jul
15
comment What are the security issues with “eval()” in JavaScript?
What research have you done? Reasons to be wary of eval are described in a number of places. "nobody ever goes into detail about what they are" - Citation needed. This is clearly false. Just do a search on "eval" on this site and you'll find a bunch of posts that provide various levels of detail about risks with eval. See, e.g., security.stackexchange.com/q/25642/971, security.stackexchange.com/q/30365/971, security.stackexchange.com/a/90764/971, security.stackexchange.com/q/23192/971, to list a few I came across immediately.
Jul
15
awarded  Good Answer