New answers tagged

1

This is a great question, I'm not 100% sure, but my guess is that it's a proof of age that the PGP key is newer than 2013-10-19. My reasoning is as follows: What makes blockchain mining computationally hard is fiddling with the nonce until the hash of that block has a specific number of leading zeros (16 hex zeros, or 64 binary zeros in this case). Once you ...


-1

Does this establish a minimum age of the UID? No, it does not. It establishes a minimum age of the blockhash, not the other way round. If you'd want to prove the age of a UID, you'd have to do so throughout the Bitcoin network (which I don't think is possible). Or some other benefit? Only the key's holder can definitely answer for his individual ...


1

The UUID can be tracked by TeamViewer, but do not expect them to tell you anything as that would likely require a subpoena. But let's take another look at this. So you gain the knowledge that the UUID belongs to say: Drugov Russianomov somewhere in Romania. Now what? Your course of action to minimize the potential of someone 'owning' your TeamViewer sessions ...


1

Non-cryptographically-secure PRNG's are vulnerable to analysis which can determine the parameters that generate the sequence. Once you know the sequence, it is possible to determine not only the next value, but also the total number of sequence numbers in use. See https://en.wikipedia.org/wiki/German_tank_problem for a fascinating example of doing this in ...


4

Math.random() is usually seeded from the current time of day. Therefore there is a chance that collisions will happen for objects that are generated around the same time each day. From a security perspective, this means that these "random" values will be predictable by an attacker. Even if seeded with something else, a non cryptographically secure pseudo ...


2

What steps should I take next to protect myself in case? If you're really concerned that someone might be using your google account on a different Chrome (which would result in Chrome syncing their autofills to your Chrome), make sure you have 2-Factor Authentication enabled for your Google account. You can also set a "Sync Pass-phrase" for your Chrome ...


1

We can't give a definitive answer from the info you've given. That said, I wouldn't worry. Most identity theft attacks wouldn't type things into your Chrome browser. Once an attacker can type things into your browser, there are better attacks (eg: stealing financial info) than identity theft that they can perform. Most likely, this is a problem with auto ...


1

Step back and take a look at your problem from a different viewpoint. What is the worst thing that could happen if you used sequential numbers? You've mentioned enumeration: what is the threat from enumeration? Can someone cause a problem if they see you issue #00015 and #00016, and predict that ID #00017 will likely be generated next? Perhaps someone ...


2

Yes. A crytographically secure RNG is necessary to accomplish all the things you listed. I don't know how Math.random works, but think of a TERRIBLE RNG we'll call 2bitRNG that's seeded with just 2 bits, but produces 128 bit numbers. I seed 2bitRNG with my 2 bits of entropy, and then produce 10,000 random numbers with it. Since I've only seeded it with 2 ...


2

tl;dr: That depends, if you can, use a CSPRNG. While often UUIDs are used which are not (bound to be) from a CSPRNG, this might not be a good idea in cases the (not CS)-PRNG is not re-seeded regualarly (as in long-living server processes) If the algorithm you use to create such identifiers is known - and it's input can be estimated with a few samples (as ...


1

I would definitely recommend using a cryptographically secure random number generator wherever possible regardless of what the data is. The upsides outweigh the downsides. Also, you never know what this code might be used for later. When I do code reviews, in most circumstances, I will always flag the use of a non-cryptographically secure random number ...



Top 50 recent answers are included