Reputation
3,581
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
10 22
Newest
 Nice Answer
Impact
~113k people reached

  • 0 posts edited
  • 33 helpful flags
  • 342 votes cast
Apr
2
answered Why can passwords be used to encrypt data, but are less strong for authentication?
Mar
28
comment When encrypting cloud-stored data, is it acceptable to use the user's account password?
If one uses a separate datastore for the keys than they do for the data, I think it provides a meaningful improvement.
Mar
26
awarded  Nice Answer
Mar
25
comment When encrypting cloud-stored data, is it acceptable to use the user's account password?
Expecting (or worse, trying to force) users to provide high-entropy passphrases is an exercise doomed to failure.
Mar
25
answered When encrypting cloud-stored data, is it acceptable to use the user's account password?
Mar
11
comment Why would an encrypted file be ~35% larger than an unencrypted one?
@drjimbob Being utterly clueless about details like this pretty much ensures I will never trust ownCloud for any kind of security guarantees ever.
Nov
27
awarded  Notable Question
Nov
18
comment Why does an overload of requests give one root access all of a sudden?
This isn't a saying. And it doesn't.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
Seems weird to me, @SteveSether. It's actually less effort to use a password manager, because you only have to hit a single hotkey to login. Not to mention, you have to remember whether or not it was a site that you used your "insecure" password for.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
If they're on your machine to hack it, you've already lost. If you're worried about someone hacking a copy uploaded to a cloud provider like Dropbox, iCloud, or Box, these file formats are published (example) and generally well-regarded by the cryptographic community. If someone finds a way to crack an arbitrary AES-256-CBC-encrypted, HMAC-SHA256-authenticated file at will, the world is going to have bigger problems than some passwords getting leaked. If you're that paranoid, keep it on your local machine and back up to local network storage.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
What, exactly, do you expect to "fail"?
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
@Ulkoma I don't know a single security professional at this point who doesn't use a password manager. Have a glance at what amateurs can learn from security pros. Numbers 2, 3, and 5 can all pretty much be squashed into one: just use a password manager.
Oct
30
comment What if TLS is suddenly found to have a critical defect?
I'm not at all assuming that. If there is truly some sort of trivially-exploitable TLS protocol bug, browser vendors and TLS implementors will work to find a resolution as quickly as possible. You've structured your question such that the only "real" answer you will seemingly accept is, "everyone runs around with their hair on fire while for two years while we wait to standardize TLS 1.3". If you assume such a response is patently ridiculous, then my answer is pretty much given. A fix or workaround will be found and distributed. Parties that can't update will remain vulnerable. Same as always.
Oct
30
answered What if TLS is suddenly found to have a critical defect?
Oct
29
comment Can using emojis make someone's password safer?
Not to have sour grapes, but it's generally considered good practice to withhold "accepting" an answer to a question for enough time to give multiple people a chance to provide answers. Accepting too early discourages additional answers.
Oct
29
revised Can using emojis make someone's password safer?
added 325 characters in body
Oct
29
comment Can using emojis make someone's password safer?
Yes, but I specifically mentioned lowercase letters in the example I gave. The entire point of my answer is that increasing the symbol count (e.g., 26 to 52) doesn't increase entropy as quickly as slightly increasing the length (e.g., 8 to 10).
Oct
29
revised Can using emojis make someone's password safer?
added 264 characters in body
Oct
29
revised Can using emojis make someone's password safer?
added 264 characters in body
Oct
29
answered Can using emojis make someone's password safer?