25,584 reputation
862126
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 7 months
seen 6 hours ago

This is not the profile you are looking for.


2d
comment Multiple Gmail accounts on the same device
This is not a security question. Furthermore, only people at Google can provide an answer and I doubt they are allowed to.
Dec
21
comment Is e-mailing personal information significantly riskier than transmitting the same information another way?
hat me please! :)
Dec
18
comment Is Linux's 'W' command a security breach?
@cpast Both comments can be combined into a single pretty good (and correct) answer. :)
Dec
18
comment Is Linux's 'W' command a security breach?
@cpast That comment should be an answer.
Dec
15
comment HMAC-SHA256 Transaction signing
I'm not sure what this is about. TOTP is simply HMAC applied over the current Unix ntimestamp and truncated to 8 digits. Sure, you can derive the HMAC key from the transaction details somehow but that isn't "signing". You need to describe in more detail what you have in mind.
Dec
13
comment Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
@DavidHoelzer " but the overall overhead at the server end is quite substantial." Commonly repeated myth but completely untrue. See: istlsfastyet.com
Dec
13
comment Necessary components for PGP
If we want to go as generic as possible, I'd say symmetric and asymmetric encryption.
Dec
8
comment Timing attack against HMAC in authenticated encryption?
Excellent! I thought this was a Bear answer at first. :)
Oct
13
comment One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
Your second point is false. There are algorithms that are information theoretic secure which means they remain secure even in the face of attackers with unlimited computing power.
Oct
11
comment Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
@AbeMiessler security.stackexchange.com/a/31846/10211 Scroll to the section on Salt Generation.
Sep
18
comment Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?
@nima I have no idea on that. I'm lucky enough to never have to concern myself about FIPS.
Sep
17
comment Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?
@nima cryptography.io/en/latest/installation/…
Sep
16
comment Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?
@nima Yes, there shouldn't be any problems with that. If there is, open up an issue on GitHub. (Source: I'm one of the developers.)
Jul
25
comment Is there something similar to pseudorandom generators but in the opposite direction?
A hash function?
Jul
13
comment Reversible Hash Function?
If it's reversible it isn't a hash.
Jul
6
comment Protocols equivalent to TLS?
SSH can be a potential alternative depending on the circumstances.
Jun
17
comment Is using Git for deploying a bad practice?
@pedromanoel I subscribe to the school of thought where anything you push to master should be production ready so that shouldn't really be a concern. What you are suggesting works as well.
Jun
4
comment How common and how easy is sniffing plaintext communication?
Connect to a open wifi network, run wireshark and see for yourself.
Jun
3
comment What are the advantages/disadvatages of hashing over encryption?
There is no "advantage". They serve completely different purposes.
May
27
comment Do firewalls always run in userspace?
To nitpick, iptables is actually the userspace interface to the kernel's Netfilter framework.