May
31
answered In some situation can be dangerous to echo command (e.g. rm -rf *) using a script?
May
12
revised How can I check if someone tampered with the CCTV footage or system?
updated link
Feb
13
awarded  Yearling
2018
Jun
28
comment How many rounds of hashing is enough for a password manager?
@kloddant so security by obscurity? First, offline password managers hardly have "government backends" or sell your passwords on the black market. If you get infected with any kind of malware, it may be able to distinguish between a known, secure password manager (and throw its hands up) and a DIY version, which can be more easily attacked. Plus, OP's password manager is now open source (and deleting it now doesn't help) and probably less secure than most open source password managers.
Jun
22
comment TLS and IPsec use cases
Overall a good answer. I would correct your last statement about TLS (DTLS exists precisely to support UDP and so on), and explain that TLS can be used for VPN as well, just at a different OSI layer and in different use cases than IPSec.
Jun
22
comment How to recover forgotten AES-256 password with bruce force?
Is there some kind of limit on the number of attempts?
Jun
21
comment How to estimate the time for a hacker to crack a strong password
@PhungD.An simple! Each computer can handle 826 bcrypt hashes per second. 100 computers can compute 826*100=82,600 bcrypt hashes per second. In a month (since you would change every month), they can do 82,600*60*60*24*30=214,099,200 bcrypt hashes. If the password is random, they cannot crack it before 161 million years or something like that (with probability 50%). ----> Bcrypt(randomly generated password) is OK.
Jun
20
reviewed Approve When using Symantec security, is our IP address our own or shared, should we whitelist?
Jun
20
comment Simple defense against power analysis?
@jensen68 (I am very late to the party, I know). You ask ". How is it possible to detect the spikes if the additional waves overlapse. The more waves you overlapse the more random it gets". I ask you: have you ever listened the radio or watched the TV? Noise always overlaps with the signal carrying information. There are lots of techniques to extract a signal from noise, and the fact that you can't recognize the original waveform looking at an oscilloscope doesn't mean much.
May
17
answered Why are CSRF vulnerabilities considered to be a problem with the web app, rather than with the browser?
May
15
revised Is it possible to identify mobile phone user with voice recognition
improved answer
May
15
comment Is it possible to identify mobile phone user with voice recognition
@tomK. the paper I quoted mentions a sample of men and women speaking Arabic. A 2006 classified memo by the NSA (leaked by Snowden) mentions that they "can identify voices largely independent of the language spoken". Voice disguises may be a problem. Yes, this is speculative, but the question asks "is this possible?". My answer to that, supported by references to a paper and some computations, is yes. Is this system practically used? I don't know.
May
15
revised Is it possible to identify mobile phone user with voice recognition
corrected spelling
May
15
revised Is it possible to identify mobile phone user with voice recognition
added 57 characters in body
May
15
answered Is it possible to identify mobile phone user with voice recognition
May
14
awarded  Revival
May
3
answered Retention of IP Address
May
3
answered Rolling your own crypto
Apr
27
answered Access Token or User Id
Apr
27
answered Can we trust onetimesecret?