1,717 reputation
514
bio website touset.org
location San Francisco, CA
age 30
visits member for 1 year, 8 months
seen 20 hours ago

Cyclist. Rubyist.


2d
comment Using pattern matching to make a port more secure
SYN cookies, as suggested by @imjoevasquez, seem to be what you're looking for.
Apr
15
comment Minimize collision risk for any hash function?
You are worrying about a made-up problem. Given a 48-bit input, you nor any of your users are ever going to experience a collision in any of the SHA-2 variants.
Apr
15
comment Minimize collision risk for any hash function?
You need a unique identifier. Why does it have to be derived from anything? Why not a UUID?
Apr
14
comment Cryptosytem Question
What was the goal of the cryptosystem to begin with? This looks like a success, not a failure, to me.
Apr
10
comment Heartbleed - is this scenario possible? how bad would it be?
It would take an astonishing amount of incompetence for a CA to use their root signing key directly to secure TLS connections.
Apr
10
comment Why not ask for a password and 2-factor token at the same time?
This is not how OTP tokens actually work. The server stores a seed associated with each device, and when an OTP is submitted, the server simply computes a function on the seed and (depending on whether you're using HOTP or TOTP) either a counter or the a timestamp.
Apr
4
comment Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?
MD5 isn't a poor password hash because of its broken collision resistance. It's a poor password hash because it is fast.
Apr
3
comment SQL Injection via Unicode
Your castle walls are made of tissue paper, and you are asking us how to protect against a specific make and model of catapult. The problem is not the catapult; it is the tissue paper.
Apr
3
comment Multiple user encryption-key store
Shamir's Secret Sharing sounds like what you're looking for. Square's article on their Parliament service is an implementation of this.
Apr
2
comment Is giving out login information to a read-only mysql database to the public a security threat?
Assuming no queries could be run, there would be no point in giving them a password anyway.
Apr
2
comment Accepting an untrusted security certificate?
If you're authenticated, an attacker can easily steal your session cookie and capture your session. Or they can use Javascript to perform actions on your behalf.
Apr
2
comment Protecting form post values when on https
You are making your life exceedingly difficult. Save the form state server-side and issue the client a token that associates with the saved information. Passing data forward through page after page after page is the path to madness.
Apr
2
comment Is giving out login information to a read-only mysql database to the public a security threat?
How can that question possibly be answered without knowing what kind of data is in the database?
Apr
2
comment Spam that comes from names in my address book, but not their email addresses
Usually it's not the people whose names are in the emails that are compromised. It's some other acquaintance of you both.
Mar
31
comment Utilizing PBKDF2 With OpenSSL crypto library
Your language of choice almost certainly has a library that already implements PBKDF2. This is (IMHO) extremely preferable to shelling out to the openssl command line or trying to talk directly to the (horrifyingly bad) libssl API directly.
Mar
30
comment Using pattern matching to make a port more secure
I don't think you've made your question clear enough to demonstrate exactly what it is you're trying to accomplish, what threat you're trying to mitigate, and what the effects you're experiencing are. If someone is spoofing IP addresses when making requests to a service of yours, the TCP handshake won't complete. What more are you looking for?
Mar
30
comment Relationship of password strength and key strength
It hasn't been mentioned, but password-based KDFs (ex., PBKDF2) are iterated many times. This increases the "effective" entropy of the password by requiring a high amount of computation in order to brute force. However, this additional cost is linear whereas increasing the actual entropy of the password increases the cost exponentially.
Mar
30
comment Using pattern matching to make a port more secure
Why is TCP alone not enough to prevent this?
Mar
28
comment Are there limits (or, what are the limits) to our understanding of AES's resistance to known plaintext attacks?
If there was something like that, we would consider AES broken.
Mar
28
comment Free SSL Certificate when encryption is needed and not trust?
What stops me from sitting in-between traffic from a client and your server, and pretending to be your server?