60,260 reputation
6110295
bio website
location
age
visits member for 4 years, 3 months
seen 11 hours ago

2d
comment The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?
@TheEnvironmentalist, those answers are phrased in terms of VMs but similar barriers/challenges apply to other kinds of sandboxes as well (e.g., OS-level sandboxes, application-level sandboxes, and so on). Did you read the Garfinkel paper? The standard advice on this site is that if your question is not answered by those answers, you should edit your question to narrow its focus on specifically the part that's not covered, and consider stating explicitly what question you have that's not answered there.
Apr
22
comment The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?
What research have you done? See "red pill" research, the Garfinkel et al paper from HOTOS 2007, security.stackexchange.com/q/10577/971, stackoverflow.com/q/154163/781723, stackoverflow.com/q/39533/781723. You probably want to use a bare-metal machine, though this limits your ability to observe its execution (you can observe the state before it executes and the state afterwards but it may be difficult to observe and interact with its state while it is executing).
Apr
21
comment How can I ensure my dll has not been modified?
Please edit your question to explain your threat model. What kinds of threats are you trying to defend against? What kinds of attackers or scenarios? What are your goals, i.e., what are you trying to prevent? Are you trying to ensure the user has a valid licensed copy of your software? Are you trying to do DRM? How would you respond to @bdsl? Please read the comments in security.stackexchange.com/help/on-topic and edit your question accordingly (e.g., "What background should I give in my question?").
Apr
21
awarded  Nice Answer
Apr
19
awarded  Famous Question
Apr
19
comment Should I be afraid of biometric IDs?
@ShaulBehr, I suggest that you post on Meta and make your case there; that's a better place to have a discussion than in the comment thread here. (My take: In general, there is no exception to the rules for popular questions. And in this case, this question made it on Hot Network Questions, which is known to distort vote counts and view counts; those have to be interpreted with special care for questions that are featured on Hot Network Questions. See e.g. meta.security.stackexchange.com/q/1585/971.) But the community could discuss it, on Meta.
Apr
19
awarded  Announcer
Apr
17
comment Should I be afraid of biometric IDs?
This answer has some good material but I recommend you radically edit it to focus on the technical question here: what are the risks? I see two parts of the answer that try to articulate the risks: the bullet item beginning "Biometric data could be misused", and the last two paragraphs of the answer. The remainder of the answer is a combination of an appeal to emotion and generic, tangential comments about biometrics that don't really answer the question about risks; I suggest those parts be edited out. Would you like me to have a try at editing it?
Apr
17
comment Should I be afraid of biometric IDs?
3. "Should I be resisting/joining campaigns resisting this legislation?" is a subjective question that is not suitable for this site. (Opinion polls are not suitable.) I've edited your question to remove that part. Please see security.stackexchange.com/help/dont-ask for guidance about how to ask questions that are suitable for this site format. Feel free to edit your question to improve it further, after reading those guidelines.
Apr
17
revised Should I be afraid of biometric IDs?
Remove subjective "opinion poll" about whether we should oppose the requirement.
Apr
17
comment Should I be afraid of biometric IDs?
1. "What are the risks?" is a pretty broad question. One could write an entire book about the topic, and people have. The question might be more suitable if you can narrow this question down to one about a specific biometric technology. 2. There's a lot written about the risks of biometrics. What research have you done? We expect you to do a significant amount of research before asking, and to show us what research you've done in the question. See security.stackexchange.com/help/how-to-ask.
Apr
14
awarded  Good Question
Apr
13
awarded  Famous Question
Apr
9
awarded  Announcer
Apr
6
comment How hash ensure integrity of data?
I found all of these in just a few minutes using search and by perusing the hash tag. In the future, please do more research before asking -- we expect you to do a significant amount of research before asking, including searching on this site for similar questions.
Apr
6
comment How hash ensure integrity of data?
This is already covered by several other questions on this site: Why we use GPG signatures for file verification instead of hash values?, Does hashing a file from an unsigned website give a false sense of security?, when people say a file has a checked md5 hash, what exactly does that mean?, and How can I check the integrity of the downloaded files?. (cont.)
Apr
6
comment Is it dangerous to show all the JavaScript functions in my web application?
Dup of security.stackexchange.com/q/30928/971. See also security.stackexchange.com/q/3174/971 and security.stackexchange.com/q/35828/971.
Apr
3
comment Is SiteKey a valid defense against Phishing?
@loneboat, yup! MITM attacks can defeat a bunch of other mechanisms as well. Note that in a phishing setting (which is what SiteKey was designed to protect against), a MITM attacker doesn't have to defeat SSL (unless the bank is advanced enough to use HSTS): the attacker can just send you to HTTP.
Apr
3
comment Is having the username and password fields on different pages more secure?
Are you sure there aren't additional features present during this process, such as a random image to help you authenticate the bank (a la SiteKey)?
Mar
31
awarded  Notable Question