Aki

Aug
17
awarded Yearling
Jul
28
awarded Necromancer
Jul
6
awarded Yearling
Jun
25
awarded Famous Question
Jun
22
comment Can I detect a MITM attack?
I proven Perspective unusable here: security.stackexchange.com/questions/12081/…
Apr
30
accepted "Something came up" in Japanese
Apr
27
comment How to suppress Update Links warning?
watch out, your excel seems torn
Apr
22
asked "Something came up" in Japanese
Mar
10
comment What are the security implications of "Row Hammer" attack?
"A system could ensure that, within a given refresh period, it does not activate any given row too many times without also ensuring that neighbouring rows are refreshed?" From your own link... For us mortals this just means change RAM on critical servers/network
Mar
10
comment Why do phones have SIM cards?
@moose: I guess I did not express myself clearly enough. I know what you mean, there are a few issues to solve going that way. My point was, if you really want to get rid of the sim card concept (not only the hardwaore), you're going to have to solve a whole other bunch of problems. I wanted to counter OP who implied we could simply get rid of this as it is a remnant of the past. My point was that he just wanted a simplified where the SIM data would be moved not solely to a remote server but also to persistent storage, thus proving pointless and creating more problems and limitations.
Mar
9
comment Why do phones have SIM cards?
@moose: Then how do you save the set up ? If you reguard sim as persistant storage with initialization data on it, then you realize it is the everywhere as the minimal information needed to make the connection that will help you retrieve your account data and allow you to use the network. If you remove that sim, you still have to move the data to storage, which makes a sim free phone in it's implementation but not in concept. Then changing user/operator would mean flashing/replacing your storage. Easier with low coupling and dedicated replaceable device, right?
Mar
4
comment What non malicious uses are there for ping's flood (-f) option?
It's by far the worst tool available for this purpose though
Feb
26
comment screen scraping using Ghost.py
it did not for me
Feb
23
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
And adding to that, defense level actors are working together with such firms of course, access to foreign technologies to empower local companies is a day-to-day activity for the spying business. I want to stress that nothing changed, Chinese companies put malware as Cisco and other companies add backdoor and channel out data to others. It is the same, it is a matter of trust and strategy, do not overreact and work on your company strategy would be the best.
Feb
23
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
@RŠ¾ryMcCune: Sorry my English is not that great, I did not mean to suggest defense level companies would be a threat. More to compare how they defend against those threat because there is a high value to doing so. For companies, you can try to go as far as them, until the cost/benefit ratio exceeds your budget and strategy. >What are the security risks of having OEMs or other companies installing this kind of software onto customers systems? The risk has always been present in the mind of security professionals, vendors identified as non-secure will be avoided, as always.
Feb
20
awarded Supporter
Feb
20
comment Why do phones have SIM cards?
Basically you propose to always have a sim in the phone when you buy it (if you think about it, you can think of such phones as sim free). It exists. To remove the sim card means to still have the data in the phone, it's just a flat design easier to maintain and diagnose for operators/phone manufacturers.
Feb
20
comment Certificate advice for deploying code-signed software as a 3rd party vendor
You can just put it in the agreement signed by both parties an obligation to protect the certificate. You could have one especially for this project and only give it to the dev company? So if it leaks, you can point your finger at them. Definitely sign your applications, but most importantly teach users to only download it from a trusted source. Also, regular audits should also focus on checking sensitive applications are legits (cksum...)
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
Defense level companies control the whole manufacturing chains. This kind of attacks are not new. For organizations, it might make sense to select vendors based on their reputation. This kind of news about Lenovo and others should definitely influence the market at some level. It does not mean your grandmother needs a Chinese-only laptop (assuming you are Chinese).
Feb
16
awarded Altruist
1 2 3 4 5