2016
Nov
9
asked Does mounting a LUKS partition authenticate it?
Sep
21
asked Do human challenge-response authentication schemes exist?
Feb
9
awarded  Yearling
Feb
9
answered If all ports are closed, do I need firewall?
Jan
20
awarded  Citizen Patrol
Jan
19
awarded  Critic
2015
Nov
7
awarded  Editor
Nov
7
revised how much time does it take to fully destroy a deleted video from SD card?
Fixed grammar
Nov
7
suggested approved edit on how much time does it take to fully destroy a deleted video from SD card?
Jul
22
awarded  Caucus
Mar
7
awarded  Commentator
Mar
7
comment Technology that can survive a “Rubber-Hose attack”
There's this for an example. It is a contactless smart card, running solely off the power it receives through NFC. Low-power ECG and EMG (electromyograph) devices do exist. A Low-power ECG analyzer is used in every implantable pacemaker - an EMG version could be made too, as voluntary muscles give off of electric signals similar in amplitude to those of the heart. Of course, it requires specialised hardware which an individual does not have access to. Which part of my answer do you object to?
Mar
7
comment Does any OpenID identity provider allow site-unique arbitrary email addresses?
If there isn't one, you could roll your own OpenID provider that supports it. It won't be easy, but since you've already got a domain...
Mar
7
comment Technology that can survive a “Rubber-Hose attack”
Your life (or thumb, even) is worth more to you than the money the bad guys could steal using your ATM card. The data Mr. Snowden has access to may very well be worth protecting at the cost of his thumb, or even his life. This is not unheard of - take a look at Suicide pill on Wikipedia.
Mar
7
answered Technology that can survive a “Rubber-Hose attack”
Feb
5
comment Randomness of hash token in password reset link
The fact that an attacker could theoretically (for very large quantities of theoretically, but still) guess the way the hash is computed, request a password reset for an user and change her password without receiving the hash. Since you have to store the hash anyway, why not make it unpredictable and unrelated to everything else? I'd say even a weak but long pseudorandom number is better than something with a crackable, guessable structure.
Feb
5
comment What could be the possible exploit for android adware vulnerability?
In the WebView vulnerability, the attacker is a webpage, and the vulnerability grants access to the rights the app providing the vulnerable WebView has. So it grants the malicious ad provider (which hosts the WebView) no additional rights. XSS would also not be possible in the traditional sense, because the system browser and WebViews are isolated. It would be possible to get the user to use their rogue browser and get their credentials and do evil stuff XSS was invented for - but a) that's still not XSS and b) I seriously hope no one's gullible enough to log into their bank acc in a popup.
Feb
5
answered What could be the possible exploit for android adware vulnerability?
Jan
22
comment High Level NSA Target, Help/Feasibility
+1. #4 is also possible if they ever had access to your system. They could have flashed a rogue BIOS/UEFI fw that runs anything that you boot inside a thin VM and then uses the WiFi card to broadcast anything it wishes.
Jan
22
comment Besides MBR & BIOS, is it possible for a rootkit to stay persistent after a format of the hard drive?
BadUSB also deserves a mention here. A lot of laptop computers and motherboards have built-in USB "peripherals" (Bluetooth radios, webcams) which have the potential to do anything to your system while it's booting. Theoretically. For very large amounts of theoretically. (I really like this phrase, Iserni). Also, if you want to be paranoid, you have no idea what those chips on your motherboard actually do. Or that BIOS you just reflashed and you trust so much.