Reputation
28,256
Next tag badge:
221/100 score
19/20 answers
Badges
4 59 124
Newest
 Nice Answer
Impact
~1.4m people reached

1d
comment Vulnerabilities despite FIDO U2F?
With RSA tokens, the key is symmetric and must be held by the authenticating entity. With U2F, the attestation signing currently is modeled on signing where the device gives the creator its public certificate. The private key can be generated on-device and never read. See forum.yubico.com/viewtopic.php?f=33&t=1666
1d
comment Using smart cards for email encryption and SSH
Well, I'll say again from being a huge fan of Yubikey that I think it's entirely worth it and I'm excited by the openness: U2F and PGP being open standards with hardware can be acquired elsewhere (namely, the cards). U2F vendor list: fidoalliance.org/certification/fido-ready
2d
answered Using smart cards for email encryption and SSH
2d
answered Vulnerabilities despite FIDO U2F?
Aug
19
awarded  Nice Answer
Aug
17
awarded  Necromancer
Aug
13
answered How is Facebook accessing my iPhone texts in order to recommend friends?
Jul
29
awarded  Nice Answer
Jul
24
awarded  Constituent
Jul
24
comment Does SSH password authentication provide the server with the password?
It's a solvable problem (server stores password with N+I iterations, client sends N, server computes I iterations). The technical reason to no due this is that the hash has similar vulnerabilities to a regular password in almost all cases. Further, the client and server must agree on a protocol with the client executing that code. Either a risk from code being push from server or an update nightmare for the client. Therefore, the KISS principle applies and passwords are sent plain via standardized encrypted links.
Jul
23
answered Does SSH password authentication provide the server with the password?
Jul
23
revised How does malware performs a UDP hole punch?
deleted 1 character in body; edited title
Jul
22
reviewed Leave Open How secure is socks5 proxy over ssh?
Jul
14
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
Comments are not for extended discussion; this conversation has been moved to chat.
Jul
13
comment
In our last moderator election 3 years ago, Scott came in 2nd. He has maintained a presence in the site and chat since that time.
Jul
13
awarded  Caucus
Jul
13
wiki
Jul
13
answered Should traffic between two hosts in the same data center be encrypted?
Jul
11
reviewed Approve Using Tor browser to use YouTube and account security
Jul
8
comment Ali Express hijacking my Chrome
Discussion about whether this is on-topic in meta: meta.security.stackexchange.com/questions/1858/…