Andrew Russell
  • Member for 10 years, 9 months
  • Last seen more than a week ago
Why does one need a high level of privacy/anonymity for legal activities?
25 votes

Turn the question around We would need a society where everyone was trustworthy. All ISP's that handle my traffic. All Web sites. All users on the Internet, for every country. All governments (how ...

View answer
Can webcams be turned on without the indicator light?
22 votes

It seems as if the design of my ASUS notebook is good in this respect. It uses a hardware video shutter, that cannot be turned on electronically. That is a great solution to the privacy issue (...

View answer
Best practices for securing an android device
Accepted answer
18 votes

Use the features already on the phone as your first choice. The features on the phone: Are battle-hardened technology. Don't require Apps from third parties. Are very well embedded in the Operating ...

View answer
LDAP vs MySQL for Usernames and Passwords
14 votes

Privilege Separation Principle This is a classic case where isolation of your content database from your user database provides a security advantage. The Application Server knows the users password ...

View answer
A phone call hack
9 votes

There is an Epidemic of this attack in NZ at the moment. We have been called about 5 times over the last 6 months. The attacker wants to get you to open up your computer to remote access and then who-...

View answer
Can we still provide confidentiality when cryptography is outlawed?
9 votes

How about the radical approach "Stop storing information about your customers"? This is only workable for simple use cases, where the cost of having the data outweighs the value of that data. ...

View answer
Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
8 votes

You are trying to compare a Cryptographic Primitive and compare it to Cryptographic system. This is really comparing apples and oranges. Cryptographic Primitives are put together to create a ...

View answer
Ethical question regarding accessible sensitive data at school
8 votes

Contra Position I wish to take the position of Devils Advocate here. Your schooling/future is WAY more important to you than the security of the schools network. You should take the point of view ...

View answer
xml library vulnerabilities, regarding post-exploitation
Accepted answer
7 votes

The computer is not yours anymore, it is probably his. You cannot trust that he did not actually compromise your box further than you currently know about. He could have compromised the kernel, ...

View answer
Where to download OpenBSD release ISO's over HTTPS?
7 votes

I agree, they should make available a way to securely authenticate the iso's. They should provide an authenticated mechanism (to https://www.openbsd.org) to retrieve the sha hashes instead of leaving ...

View answer
What risks are there with a Bluetooth based door lock, and are there any mitigations?
6 votes

Very interesting Technology Indeed If the technology is designed, developed and safely, then it can be fairly secure. It seems to provide a lot of cool features. Configure keys to access house ...

View answer
Are the iPhone "connect the dots" passwords secure?
6 votes

Security level approximately the same as a three tumbler combination lock. i.e. A 10 year old could hack it. My experience with is with Android connect the dots security, not iPhone, so YMMV. As ...

View answer
Bypassing a reverse proxy/NAT
Accepted answer
6 votes

A number of ways, but none of them easy A Browser compromise served from an external site where you can ask a user to view a web page from the inside of the network. Compromising the Router/Firewall/...

View answer
If an XML document is not validated as "Well Formed" or checked against a schema, what are the risks?
6 votes

Secure XML processing using DTD's and XSD's is tricky. You should ensure that the correct dtd's and xsd's are referenced for your use case before processing the xml file with a parser (and that mixed ...

View answer
LastPass login security
Accepted answer
5 votes

No, The LastPass website does not normally know your login credentials. On their website, they supply JavaScript code to do in-browser decryption. So, yes, we still need to trust LastPass that this ...

View answer
Securing a multi-tenant architecture
5 votes

Database Layer The multi-schema approach is OK but as always the devil is in the detail. One major isolation technique that is underappreciated is separate schemas for the data owner and for the web-...

View answer
Is it safe to attach a potentially malicious hard drive to a Solaris machine?
5 votes

Use a special purpose live CD GParted Live CD Seriously, if you are worried about custom hacking kit hidden inside your second hand hard drives, then go and buy them new from a legitimate verified ...

View answer
Backup is corrective control or a preventive control?
4 votes

Corrective Control It isn't a control until it can be used and the only benefit is corrective, it does not prevent the media loss, it just helps fix the media loss. Who cares that it needs to be ...

View answer
Why does one need a high level of privacy/anonymity for legal activities?
4 votes

Actually answering the Question posed. Concrete example where you need strong security for legitimate activities: Confidentiality of a Merger and Acquisitions deal is extremely important, up until ...

View answer
Why do some websites need time to log you in securely, while others can do it instantly?
4 votes

Security Theatre This splash screen is not necessary for the user, but the company chose to introduce a the splash screen showing that they think security is important and saying that they are ...

View answer
Heartbleed - is this scenario possible? how bad would it be?
Accepted answer
4 votes

They are two different services, that are not related. PK Signing service These keys use the CA's crown jewels. They are protected as much as they can. If they are lost, they will be Out of Business ...

View answer
Obfuscating JavaScript code
4 votes

Of course this is a baseless fear. Javascript is only one part of a larger ecosystem, much more important is brand, site usability, site integrity, responsiveness and network effects. Yeah, ...

View answer
can ssh passwordless public key authentication be ok if combined with a VPN?
4 votes

Your question revolves around storage of private keys not the ssh authentication mechanism. So, to the answers: Yes the ssh private/public key mechanism and protocol seems to be secure. Yes the ...

View answer
Challenge Response across several hops
4 votes

If you own/trust the Reverse Proxy, Load Balancer, and Intended Server(s) then: Your client mobile phone has the client certificate (through some secure means) which it uses to authenticate to the ...

View answer
Is there a value in using portable programs on a USB key?
3 votes

So answering backwards: Yes There is advantage to using portable programs on a USB key. Access to programs not available on existing OS configuration. Versions not available. Not leaving wholesale ...

View answer
Why does initial encryption take so long?
Accepted answer
3 votes

Veracrypt and it's predecessor Truecrypt transform plaintext disk content to cyphertext disk content on the fly. There is a one-off process to convert the plaintext to cyphertext when commissioning ...

View answer
Can teleworking let my boss to sniff my network traffic? What else could he do?
Accepted answer
3 votes

Fairly Safe for most purposes. For a remote desktop tool like VNC, Citrix or Remote Desktop These tools are more or less constrained to the graphical window on your box, they might be able to access ...

View answer
Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
3 votes

Architectures you could use: For data that is not subject to change, you can use a push method putting the content on the website using an authenticated and secure method (vpn, https or ssh/sftp) in ...

View answer
Any campus email systems automatically testing links?
2 votes

In theory this should not happen. But for short periods I can see it happening, in certain not carefully tested systems. The http standard includes the following actions, HEAD, GET, POST, DELETE and ...

View answer
Protect our payroll data from a legal and moral obligation
2 votes

You have a very interesting problem. You need to resolve these issues, as you probably have a time bomb on your hands. (assuming that you haven't already solved the issues) You don't sound as if ...

View answer