security
Don't let them paste passwords...
After months of tweets, emails & articles from eminent figures like Troy Hunt & the NCSC, it's about time I weighed in on the debate surrounding sites which disable a user's ability to paste passwords. The general consensus amongst many experts, including those mentioned above, is that disabling paste on password fields reduces security; the NCSC went one step further, calling it "completely pointless" and "damaging". So without further ado, allow me to explain why I believe disabling pas
Bank & Mobile Network Security: For want of a nail...
Ever since publishing a "two factor authentication vs two step verification" article in 2014, I've been waiting for an opportunity to irrefutably demonstrate the difference. Note: This article is very much a "work in progress" as until both exploits are patched, I can't provide any technical information. A quick recap... If you haven't yet read the above article, let's quickly recap on the differences between two-factor authentication & two-step verification. A "factor" falls into o
EveryKey Revisited: Military grade? Give me a break.
Update 27/04/16: Here are some screenshots of the EveryKey Windows app. It's not digitally signed, so there's no way to ensure it's genuine and hasn't been modified, it crashes if you click the toolbar & if you click "forgot password", it opens Google. To be frank, it looks pretty thrown together at the moment. Thank you for the anonymous tip folks. Update 12/04/16: EveryKey have replied to this post. Read it here. In May 2015, I questioned if EveryKey, one of Kickstarter's most succe
PwnPhone: Default passwords allow covert surveillance.
A few weeks ago, I was asked to observe an installation of several wireless access points & VoIP phones, with a view to making recommendations on how best to improve security while maintaining ease of deployment. It didn't take long for several trends to appear; chief amongst which was the use of We'll just use defaults, for now. That password will do, for now. Of course, as soon as the device burst into life, it's on to the next one. At which point, "now" becomes a distant memory, alo