pjc50
  • Member for 8 years, 8 months
  • Last seen more than a week ago
Why is it dangerous to open a suspicious email?
61 votes

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook&#...

View answer
Can I prevent my neighbors, whom I pay for shared internet (WiFi), from seeing the sites I've visited?
48 votes

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.

View answer
Is a server infrastructure fundamentally possible which the smartest person can't breach?
Accepted answer
31 votes

Security can be proven, but you have to understand what is proved https://sel4.systems/FAQ/proof.pml Our proof statement in high-level natural language is the following: The binary code of the seL4 ...

View answer
How to protect my code from “insider” threats when hiring my first employee?
18 votes

The last thing that I want happen is what happened to Tesla where someone dumped the source code onto iCloud and ran off with it to a competitor. And after that Tesla failed and were never heard of ...

View answer
Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?
15 votes

When a legitimate law enforcement organization has need of a key to decrypt, it sends a formal request to the NGO. The NGO first analyzes the request based on the importance of the request. the NGO ...

View answer
Hotel reservation. How is this secure with only credit card number and expiry date?
13 votes

The trick with credit cards is to remember the credit part of the system. You're not actually paying at the point of sale, you're creating two credit relationships where you owe the issuer money and ...

View answer
How do I verify that WhatsApp is using end-to-end encryption?
13 votes

I actually did some work on reverse-engineering the WhatsApp protocol a while ago. At that time, it was SSL-encrypted over Wi-Fi and cleartext over 3G. It's possible to root your Android device and ...

View answer
Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?
11 votes

There speaks someone who has never run their own email. You don't mention an inbound antispam solution. DKIM and related techniques are for authenticating your own mail as not spam and making it ...

View answer
Would a CD drive on a driverless car pose a security risk?
10 votes

Never mind the CD player, your tires are conspiring against you "Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study" We also found out ...

View answer
Web authentication - password vs key file
10 votes

Nobody has mentioned the "official" way of doing this, using client certificate files. These are not sent to the server but participate in a cryptographic process. You can even store them on ...

View answer
Why would someone "double encrypt"?
9 votes

HTTPS is encrypted in transit and decrypted at the ends. So the obvious situation where you might want to double-encrypt is where you don't want one (or possibly both!) of the ends to see the ...

View answer
What's the point of the CA?
7 votes

The certification says nothing about the trustworthiness of the organisation running the website. It only says that the certificate was issued to the right people. This is to prevent man in the ...

View answer
Securing data and files so as they won't be openable anywhere else but your own server?
5 votes

The best approach is the other way round: make it so that the server that stores the files is unable to read them, by encrypting them with keys held elsewhere. Consider a system comprising a laptop, ...

View answer
Why don't OS's make keystrokes available to only the current app?
5 votes

On Windows, there is very little protection between applications running as the same user. If you try to take away SetWindowsHookEx, then malware writers will switch to DLL injection and a whole set ...

View answer
How does DRM stop copying?
5 votes

DRM is part of an attack on copying through the legal system, specifically the DMCA: https://www.law.cornell.edu/uscode/text/17/1201 and equivalent EU legislation (copyright directive). It provides "...

View answer
When do honest people need privacy or anonymity? (e.g. they have nothing to hide)
5 votes

For the fraud and "identity theft" angle on this, people should remember that dealing with it always takes someone's time and money. Identity theft can be extremely inconvenient or expensive, and your ...

View answer
Does Intel or Arm support private key memory?
4 votes

Intel can do register-to-register encryption with the AES instructions and many ARM chips have crypto accelerators with similar functions. There's two kinds of attack here: having an external DRAM ...

View answer
Old OS memory space protection - was it really that bad?
4 votes

To expand on the MMU answer, all of the early 80s "personal computer" chipsets started off without that functionality. It has a non-zero cost in chip area and delay to memory, a cost that was a lot ...

View answer
Why are overused buzzwords like Cyber and Hacking still prevalent in our industry?
3 votes

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any ...

View answer
Can I sign a single character message with the RSA private key?
3 votes

Not only is it insecure in allowing messages to be taken out of context, it can result in leaking the private key: http://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/ Hence the ...

View answer
Is exposing the server time a security risk?
2 votes

The only thing that could really expose a security risk is the high-precision timers and performance counters. These could be used to precisely time how long some cryptographic process takes on the ...

View answer
Why can't we protect the password file so that only the system can read it?
1 votes

why can't we program the computer so that it hides the password file from all users? The system is also a "user", most of the time. That is, most systems maintain a distinction between &...

View answer
How to protect files from someone who has access to the computer that contains those files?
1 votes

Depending on how critical this is and the likelihood of a sophisticated attack (your threat model), you could try the car radio approach: Use either full-disk encryption or an encrypted database to ...

View answer
Metadata-free Email: How can SENDER directly, anonymously, and securely ask RECIPIENT’s mail provider to deliver a metadata-free email?
1 votes

You can construct an empty From: header by using the special address <>, which is normally used for the source of bounce messages. This may be clobbered by anti-spam. The more usual solution to ...

View answer
Can linux (be made to) detect foreign connections to the ram bus?
Accepted answer
1 votes

This got cross-posted to electronics.stackexchange. The short answer is that it's not possible to detect all of this kind of hostile hardware attack in software. If you had a probing device on the ...

View answer
If smart hardware is evil can I still securely run software?
0 votes

Relating to IC subversion, there is this excellent paper "Stealthy Dopant-Level Hardware Trojans" which presents two practical attacks on complex ICs. One of those attacks is a "side channel" leak: ...

View answer
Why not use symmetric encryption?
0 votes

You're missing the property called forward secrecy. In a private system, I share a key with Alice. Suppose Alice is raided by the Stasi and they seize a computer which has the key. They can then use ...

View answer