260 reputation
16
bio website
location
age
visits member for 1 year, 10 months
seen Apr 12 at 21:42

Dec
20
answered For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?
Oct
10
comment How is printf() in C/C++ a Buffer overflow vulnerability?
Slightly off-topic, but I do not agree at all with your comment regarding snprintf: it is difficult to use sprintf in a secure manner (and practically impossible if you use a %s format specifier), but snprintf, when used correctly, is safe: when snprintf truncates the input, because its size exceeds the buffer, it is not silent but tells you by giving a return value equal to the buffer size.
Sep
2
accepted Could browsers improve security of stored passwords by using setuid?
Sep
2
awarded  Yearling
Sep
1
revised Is the following password-generator secure?
added 11 characters in body
Sep
1
comment Is the following password-generator secure?
@that guy from over there: sounds fun:P. Unfortunately, it seems that I was wrong and that the RNG is seeded by 16 bytes from /dev/urandom on most platforms rather than bt the timestamp (I updated my answer accordingly). This means a simple brute-force of seeds won't do the trick after all.
Sep
1
revised Is the following password-generator secure?
I was wrong about Python's Random being seeded by a timestamp.
Sep
1
revised Is the following password-generator secure?
I was wrong about Python's Random being seeded by a timestamp.
Aug
30
revised Is the following password-generator secure?
added 18 characters in body
Aug
30
comment Is the following password-generator secure?
@that guy from over there: there are less than 2^42 milliseconds in a century. My laptop could check each possible password generated somewhere in the past 100 years in half a day. If I'd know in what year the password was generated, it would be a matter of minutes.
Aug
29
awarded  Teacher
Aug
29
answered Is the following password-generator secure?
Aug
29
answered Lua loadstring, whitelisting against injection
Aug
8
comment backdoors in hardware (ie. intel/amd cpu) possible?
Not neccessarily: if an attacker would tamper with a hardware RNG (also comes with some modern CPU's) used for cryptography, or could influence the enropy sources the OS uses to seed its PRNG with, then they could make the device in question generate numbers that are indistinguisible from random numbers, but are still predictible to the attacker. You could only find out about this by examining the inner workings of the random number generator or entropy sources (which may be incredibly difficult or expensive) but you cannot detect it by simply examining the in- and output of your machine.
Jan
6
comment Is OpenSSL secure enough?
Not all security errors in SSL implementations are caused by buffer overflows: side-channel attacks on cryptographic functions (which might be a lot more difficult to avoid in pure Java code, especially timing attacks) and logical errors in the protocol implementation are more likely to cause security issues than the fact that the library is not implemented in a memory-safe language.
Jan
6
awarded  Critic
Sep
9
asked Could browsers improve security of stored passwords by using setuid?
Jul
30
awarded  Editor
Jul
30
revised Is there a real possibility of getting malware by “drive-by”?
Javascript is Turing complete, not almost so
Jul
30
comment How to secure passwords when site is opensource
I personally prefer using unique salts and a static salt. In the event that your database is leaked but the place (config file or such) in which you store your static is not, attackers still won't be able to achieve anything. It's a slight improvement, but an improvement nonetheless.