Simon Richter
  • Member for 10 years, 10 months
  • Last seen this week
  • Berlin, Germany
Does having no 'if' blocks in code mitigate side-channel attacks?
1 votes

The trick is to remove branches from those parts of the code where the pattern of branches taken gives the attacker useful information. Usually, these are areas where "carefully crafted" ...

View answer
Can my SIP conversation partner identify my location?
3 votes

SIP separates call signaling and voice data, to allow SIP routers to remove themselves from the data path. Some software does this, some doesn't, so whether the remote party is given your IP address ...

View answer
Wayback machine downloading a file called default.exe?
1 votes

That might also be a snapshot of a misconfigured web server -- back then it was normal to generate web pages from CGI programs, which would be addressed as if they were regular files, and only their ...

View answer
Does streaming a game from a dedicated gaming VM still expose my PCs to significant privacy/security concerns from installed games?
Accepted answer
1 votes

The most obvious inroad: The passthrough GPU has full access to main memory for DMA operations, mediated by the IOMMU, and to other PCIe devices in the same domain. The GPU can emit "translated&...

View answer
Where to store an important private key?
0 votes

You have two main aspects to take care of: you need to keep the key a secret while actively using it, and you need to keep a backup for when (not if) the media the key is stored on breaks. A HSM can ...

View answer
How do i validate that a PGP Public Key the user inputs is valid?
1 votes

You would import the key into a new keyring file, and use the --status-fd or --status-file option to gpg to have it generate running commentary in a fixed format that you can then process afterwards. ...

View answer
How to safely save passwords for a future administrator?
2 votes

I'd just print them out on a medium that is going to survive the device itself (so laser printer instead of inkjet), and ask the organization's administrator to put them in the organization's safe, ...

View answer
Should I compile as root?
2 votes

Traditionally, we'd install packages like these into /usr/local, which is set up with mode 2775 and gid set to the group of users who are allowed to install software. Subdirectories also have the same ...

View answer
Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
2 votes

Another possible denial of service vector is the automatic account lockout. If they attempt five logins for a legitimate user, that user will be locked out from using your service for a few minutes, ...

View answer
What's the point of providing file checksums for verifying downloads?
5 votes

It allows distribution of the bulk data through untrusted channels. For example, you could give me an USB stick and ask me to download it for you over night using my cheap DSL connection, while you ...

View answer
What is the suggested best practice for changing a user's email address?
2 votes

It depends, as always, on the threat model. What can an attacker achieve if they change the email address on the service? For example, a service that sends notifications of events I have to react to ...

View answer
Is PGP for user authentication a good idea?
4 votes

This already exists. OpenPGP has "authentication" as a possible key usage, and a PGP key can be used to authenticate an SSH session if gpg-agent is used in ssh-agent mode. I use that daily as a ...

View answer
Why can hardware assisted virtualization be a security issue?
-2 votes

Virtualization Technology allows running an operating system in a fully sandboxed virtual computer, and even allows exposing a different CPU type and different CPU capabilities to the OS, to the ...

View answer
Does replacing a bcrypt hash with an invalid hash result in no possible working password?
3 votes

Yes, that is the standard way in Unix, and has been for ages. The shadow(5) manual page answers your question explicitly: If the password field contains some string that is not a valid ...

View answer
GnuPG warning for a signed key with trust level 4
2 votes

You have assigned a trust level to a key that has not been verified yet. Verification works by finding a path of trustworthy keys from a key with ultimate trust (which should be your own key) through ...

View answer
Do Linux systems need antivirus against ransomware?
4 votes

The best way to protect from data manipulation is backups onto a machine that provides append-only storage. The simplest case of this are logfile servers -- there is a single serial link that you can ...

View answer
How does Keybase.io work?
Accepted answer
12 votes

Keybase.io provides a directory service that allows looking up public keys for accounts on other services that don't themselves support PGP, and whose account types are not recognized as UIDs on PGP. ...

View answer
Which signing key should I use for certifying other peoples public keys: master or subkey?
Accepted answer
14 votes

The four possible key "usages" are Certification: signing other keys Signing: signing data Encryption: decrypting data Authentication: signing authentication tokens When you look at your key using --...

View answer
Are there any systems to mitigate the risk of losing a Signing Key?
1 votes

Using PGP, the answer is to use a signing subkey, you can then attach the subkey to an unusable ("stub") master key and use that in everyday work. If that key is lost, the certification key can be ...

View answer
Why shouldn't I bring a computer to a key-signing party?
6 votes

It is a matter of speed and convenience, for the most part. Your basic options for signing a key: Both participants set up their computers next to each other, one reads off their fingerprint, the ...

View answer
What's the point of encrypting /boot or / partition?
3 votes

It prevents accidental leaks of private data that is copied around. For example, if /tmp is on the / partition, files from your encrypted /home partition could be copied to the unencrypted /tmp, ...

View answer
Reading physical memory frame previously owned by another process to read contents of its memory page
2 votes

Technically, an operating system could recycle pages from processes that had the same security context, because any information the new process could gather from that would also be accessible to the ...

View answer
Why do PGP master keys only have a single subkey, and tie certification with signing by default?
8 votes

Diti is almost right about the historical context, but the real historical reason is in the part he/she omitted. For quite some time, gpg used DSA keys by default, which can only be used for signing, ...

View answer
How can I ensure my dll has not been modified?
30 votes

With the low level of protection the MAC address offers, I wouldn't bother. It is less effort to change the MAC address than it is to exchange your DLL.

View answer
Is my phone carrier monitoring my traffic?
5 votes

Your carrier would not see your VPN address directly, because that is in the encrypted part of the VPN traffic -- all that is visible to them is the public IP address of the VPN endpoint you are ...

View answer
Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?
7 votes

There is a readymade way to execute an arbitrary file: pass it as an argument to the dynamic linker (which is the appropriate interpreter for a dynamically loaded executable). E.g. under Linux, cp /...

View answer
Sending passwords to someone remotely
11 votes

For SSH keys, I have them generate the key and send me the public key, then we can simply compare fingerprints over the phone.

View answer
Is Skype secure enough to transmit passwords?
1 votes

The other question is whether you really need to send a password (i.e. a shared secret) directly, or whether it would make more sense to establish an encrypted channel using a method that does not ...

View answer