LateralFractal
  • Member for 8 years, 4 months
  • Last seen more than a month ago
How do I prevent copying of my PDF files?
30 votes

There is a way to distribute the risk such that any single print-shop gains no benefit from copying your files: Visual Cryptography. But it is esoteric and it is hard-core - versus simply buying your ...

View answer
Putting my PGP ID/link on printed business cards
Accepted answer
25 votes

Considering that your public key is only usable by a computer1; you can remove clutter from your business card by having all electronic data accessible online and referred to by a QR code. The link ...

View answer
What Trusted Root Certification Authorities should I trust?
Accepted answer
20 votes

All or None. The singly-rooted CA trust paradigm we inherited from the 90s is almost entirely broken. Vanilla browsers do not track or alert if the Certificate Authority backing a SSL certificate ...

View answer
Should a hostname ever be considered a secret?
Accepted answer
18 votes

Two reasons I can think of: Attackers will know which servers are more valuable to attack. e.g. TEST_BOX_04 vs DB_BACKUP_02 Attackers will have better idea of the topology of your network: How many ...

View answer
Is there anything preventing the NSA from becoming a root CA?
15 votes

No. In addition to the obvious government Root CAs in your trust stores; the NSA is a spy agency and as such has likely already stolen the private keys of several other CAs. If they are devious, they'...

View answer
In the SilkRoad takedown, what does it mean "An IP address was leaking" in Tor?
15 votes

This is part of an expert witnesses' statement (probably an FBI technician). You can find it in a footnote on page 28 of the original sealed complaint: The code containing the IP address for the ...

View answer
Does adding two-factor authentication by OTP really make KeePass more secure
Accepted answer
15 votes

No. Security remains the same + extra cognitive overhead. Presumably the plugin uses OATH HOTP where the KeePass file or master key is re-encypted after each access with the next one-time-password. ...

View answer
Is iPhone's fingerprint signature a one-way hash?
14 votes

Not using a cryptographic hash - no. But you could use a Fuzzy Hash or Locality-sensitive Hashing. Fuzzy hashes are different from normal hashes in that they allow similar content to cluster together ...

View answer
Can we make sure that the new Lavabit certificate is not under control of the FBI?
13 votes

Can this site be trusted? No. Well, not if you consider GoDaddy subverted or subvertable. As even the published serial number or website could be an FBI plant ;-). But if you want your emails, you'...

View answer
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
13 votes

In light of the latest NSA revelations, I'd say the entire concept of commercial Root CAs is fundamentally flawed and you should just buy from the cheapest CA whose root certificate is installed in ...

View answer
What is the purpose of yubikey
Accepted answer
12 votes

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially ...

View answer
Is my developer's home-brew password security right or wrong, and why?
10 votes

Steganography would benefit from Dave's operational secrecy better than Cryptography. This might be what Dave was intuitively aiming for. Cryptography Each cryptographic solution benefits from ...

View answer
Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
9 votes

Is it possible to use OpenPGP/SSH key pairs to authenticate with a web application in a secure fashion to replace traditional password-based authentication? Yes. It is quite possible. If it is ...

View answer
Is generating random numbers using a smartphone camera a good idea?
9 votes

Would taking a photo using a smartphone and using the RAW file's bytes count as a good way to get a large random number quickly? In and of itself, no. Digital cameras are designed to capture signal ...

View answer
iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?
9 votes

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn'...

View answer
Can someone tell if you are using a VPN by your IP address?
8 votes

If you use a public VPN service: Yes. You know it's a VPN; so can a third-party. Dedicated IP reduces the problem but doesn't eliminate it, as an agency could simply ask for all IPs controlled or ...

View answer
Suggestion on how to be PCI Compliant
8 votes

First up, I strongly recommend you offload your PCI-DSS compliance obligations entirely by moving the responsibility to capture and process payment credentials over to the payment gateway provider. ...

View answer
Is it possible to reliably derive a key from a biometric fingerprint?
8 votes

Let's consider the oldest biometric method - fingerprinting. Although fingerprinting has been around since the 1890s as a forensic tool, there is still no uniform international standard for ...

View answer
Are self-signed certificates actually more secure than CA signed certificates now?
7 votes

Browser plugins like Certificate Patrol for Firefox can warn you of changes since the last or first time you visited; but you'll find that a lot of legitimate network topology and load-balancing ...

View answer
Best practices for GPG user ids
7 votes

An alternate approach and a legitimate one is to simply use a random Class 4 UUID1. This way you detach your keys from any changes in material circumstances and any shifts in your privacy attitude in ...

View answer
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
7 votes

If I put my black hat on (not this black hat... actually that hat also works): An ISP can simply perform a man-in-the-middle-attack on any of your HTTP downloads of applications or their patches and ...

View answer
How can I detect that steganography has been used?
7 votes

Steganography relies on the latent noise-to-signal ratio of the analogue source material. The "least significant" bits (actual bits will depend on codec) are overwritten by an encrypted stream of ...

View answer
Are there sha 512 rainbow tables available?
7 votes

Possibly, but given their size - much more likely to download a generation tool and a word pattern list. Rainbow tables are a carefully comprised collection of dictionary words and probable ...

View answer
Could SQRL really be as secure as they say?
7 votes

SQRL provides no ground breaking improvements. QR codes are an optical barcode format useful for short content distribution - nothing more. Any "auto-login" situation that SQRL is trying to solve ...

View answer
What block ciphers and algorithms are now safe?
6 votes

Most of the problems outlined by Mr Snowden are essentially side-channel attacks. The algorithms aren't suddenly less robust but rather the software and infrastructure that uses these algorithms. ...

View answer
Requirement to send username and password in distinct email messages
6 votes

Sounds like a checkbox item on an audit list. I don't see any true security other than perhaps making it harder for the user to accidentally forward on both emails to the same third party or mailing ...

View answer
Using only private non-government resources, how can something be sent such that the NSA will see it?
5 votes

Wanting to be noticed by the Fingermen - an odd inversion of the usual desire :-) There are ways, but I'd refrain from some of them unless you are never going to visit the USA* Use religious phrases ...

View answer
I'm wondering how I hide my identity online well
5 votes

There are two general levels of anonymity: Good enough for hiding from other routine users of the internet. Good enough for hiding from government law enforcement and surveillance agencies. As you ...

View answer
How does a key file increase the security of a password manager?
5 votes

In addition to acting as "something you have", the option to use a keyfile allows for more flexibility in the other two factors ("something you know" and "something you are") without having to ...

View answer
Is there a way to process a credit card transaction asychronously and be PCI compliant?
Accepted answer
5 votes

RAM is volatile and is not considered storage for PCI-DSS purposes - so long as the device that contains the RAM is otherwise PCI-DSS compliant. In a similar fashion, temporary storage of the CVC/CVV ...

View answer