Hot answers tagged

171

The nice and educational way This is a bit similar to your third bullet point. Nobody else should know your password, not even people you trust. That is the only way you can be sure only you have access to your account. Let's say you give me your Facebook password and a week later rumors start spreading about what you did in Las Vegas last year. ...


157

I'm the founder of DuckDuckGo. D.W. is right, if we were to violate our privacy policy we could get in a lot of trouble. Additionally, I've tried to be as transparent as possible on how we operate, both in our privacy policy and on my blog. I've thought and explored external verification, from someone like the EFF for instance, but I don't think that really ...


152

This post is about communication with people that have absolutely no technical knowledge or interest; especially people afraid of technology. Don't explain, don't complain It is incredible hard to change other people, especially if they are IT laymen and you are the expert. This is the same issue as in general communications. Avoid all sentences that ...


150

There is no proof that DuckDuckGo operates as advertised. (There never is, on the web.) However, that is the wrong question. DuckDuckGo is very clear in its privacy policy. DuckDuckGo says it doesn't track you, it doesn't send your searches to other sites, by default it does not use any cookies, it does not collect personal information, it does not log ...


95

You are trying to solve a problem that you shouldn't have in the first place: Password Reuse The concept is simple. You think of a "good" password and use that for everything. Your bank account, online shopping, your e-Mail provider, etc. The problem is, if it gets leaked by any one of them, then all of the other accounts are potentially in danger. This is ...


91

For the purposes of this discussion there are only a couple differences between web signing certificates: Extended vs standard validation (green bar). Number of bits in a certificate request (1024/2048/4096). Certificate chain. It is easier to set up certificates with a shorter trust chain but there are inexpensive certs out there with a direct or only ...


68

Funny enough, I actually don't accept your premise. As an IT professional you can read other people's emails and other communication, delete their directories etc. It is part of the professional code of conduct not to abuse your position. People trust your integrity, the same way they trust their bank's employees not to steal their money, although they could....


38

Just change the password after you're done helping them, and send them a password reset link. They will soon learn that it's easier to keep their passwords safe than to restore them. Alternatively (e.g. for a primary e-mail account), simply change their password to a strong one and communicate it to them. Explain that changing passwords and using computer ...


37

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


29

What D.W. said. But also, You don't have to trust DuckDuckGo. You don't log in, you can clear cookies, you can change your IP address, you can access it via Tor. Not being an appendage of an identity company (e.g., Google) is a big privacy plus to begin with.


29

Good stuff in other answers, let me add some remarks about proper CA behaviour. If the CA has an history of lack of security policy enforcement, of violation of "browser approved CA" agreement, of signing of non DNS names using their official root certificate (like IP addresses, or non existent DNS names f.ex. bosscomputer.private), of lack of ...


28

Your description is that the site fails to properly validate their input. This (weakly) implies a deep flaw in their code. If your input had simply choked their routine that calls PBKDF2(), then your password hash might not have been reproducible; but I would expect a simple password reset should have been adequate to clear up that problem. Deleting your ...


26

The official GnuPG documentation regarding this output is rather awkward. The OpenPGP trust model gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model By default, GnuPG uses the OpenPGP trust model. In this, you can put trust on a key, which allows it to validate other keys. Trusted Keys Keys can be trusted. Trust allows keys to validate ...


25

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


25

No. It is not safe to generate passwords online. Don't do it! In theory there are some ways that one could perhaps build a password generator that is not so bad (e.g., run it in Javascript, on your local machine, and so forth). However, in practice, there are too many pitfalls that an average user cannot be expected to detect. Consequently, I do not ...


25

Specifically for Google, if you use two-factor authentication it is safe to "weaken" your password "from a 16-character password with a search space on the order of 1030 to an 8-character password with a search space on the order of 1014" as long as you use a good 8-character password (i.e. completely random and not re-used across sites). The strength of ...


25

If it's an official service you are integrating with the provider should really have a valid, publicly signed certificate installed for the sake of security. Assuming that you need to continue on with your provider using a self signed certificate, the big difference between ignoring the certificate and adding it as trusted is the following scenario. This ...


24

Most likely it means that (like most programs written by Americans) it's never been tested with Unicode characters and you've exposed a bug in their code. It's not a high priority for them to fix, so instead they've just sidestepped the problem by telling you to not do that. It's strange that customer service deleted and recreated your account instead of ...


23

As Rook pointed out, security theatre is a big part of how consumer perception is exploited to ensure that customers believe that something is safe, without the vendor having to go through all that complicated hassle with actual security. The TSA is a great example, but there are many others: Extended Verification on SSL certificates are largely theatre, ...


23

The established solution for this problem is to use different passwords for different websites along with a password manager. That way you won't have to reinvent the wheel. I know the rule don't invent your own crypto/protocol, that's why I want to know if there exists a know protocol for a client securing himself? Not every problem has to be solved ...


17

I arrive late to this question, but hopefully I can contribute some useful information which will also help others make a more informed decision regarding the trustworthiness of DuckDuckGo. This answer gives a few reasons to believe that DuckDuckGo is putting its privacy policy into practise by investigating the technical aspects of DuckDuckGo as of 2012-08-...


17

I would assume your reasoning is something like, "If the person constructing the page chose to send some of its images insecurely, then the browser should respect that this decision was done for a reason and allow it without a warning. The page is as secure as the entity providing it wanted it to be." By contrast, the reasoning of the browser developers is ...


17

From a technical standpoint, the only thing that matters is browser recognition. And all of the trusted authorities have very nearly 100% coverage. I could say more, but to avoid duplicating effort here's a nearly-identical question with a lot of well-reasoned responses: Are all SSL Certificates equal?


17

A weak password + two-factor authentication might still be safer than a strong password alone but it will be less safe than a strong password + two-factor authentication. It all depends on how weak you go: if you go all the way and make the password trivial you effectively end up with one-factor authentication (the Google text message to your phone). But ...


17

There is no difference between DV and OF in the browser's identity field. The screenshot below shows this field for Chrome, Firefox and MSIE. For both DV and OV, only the URL (no company name) show in the identity field. When the site has EV, the company name is displayed along with the URL. Chrome and MSIE use green background to the company name, while ...


16

On any Wi-Fi network - encrypted or not, given today's Wi-Fi encryption protocols - any sufficiently skilled and equipped user of the network (and especially the network administrator) could easily access any data you transmit or receive via cleartext protocols. This includes usernames and passwords as well as web pages, documents, and other data sent or ...


16

Theoretically, X.509 chains are unlimited in length. The Basic Constraints extension can apply a per-chain limit; this is used mostly for CA that agree to issue a sub-CA certificate but want to constraint that sub-CA to issue only end-entity certificates. Implementations may have limitations. In fact, with some carefully crafted certificates, one can make a ...


16

By importing a known good self-signed certificate where the private key is unique and not compromised, the connection is just as safe as a full global CA PKI signed certificate. Those are after all also simply stored and trusted at some point. The reason to get a PKI CA signed cert is one of practicality more than security; if you have to trust a self-...


15

The Storage Root Key (SRK) is used to wrap TPM protected keys which can be stored outside the TPM. That data stored outside the TPM can be decrypted by passing it back through the TPM again for a decryption operation. Keys wrapped by the SRK can themselves be used to wrap other keys, too. This method of wrapping can be used to create a key hierarchy of ...


15

CA does not issue private keys to anybody. CA signs (using its own private key, which is kept very secret) your public key. The CA has no access to your private key at all. If the CA’s private key is leaked to Mallory, Mallory is able to issue valid certificates for any name. That means he can make almost undetectable (well, obviously, you can detect the ...


Only top voted, non community-wiki answers of a minimum length are eligible