2,921 reputation
821
bio website touset.org
location San Francisco, CA
age 31
visits member for 2 years, 10 months
seen 18 hours ago

Cyclist. Rubyist.


18h
comment Using UUIDs for non-guessable URLs
If you're using 16 bytes (128 bits) of cryptographically secure randomness, it being "a UUID" is simply conceptual and irrelevant. This is a simple application of the birthday problem. The short answer is that an attacker will never guess one of these URLs, unless you generate a truly astronomical number of them.
1d
comment Using UUIDs for non-guessable URLs
Unless _uuid_generate_random is set. More importantly, the documentation does not guarantee that the underlying implementation is cryptographically random, so even any future update could easily use something worse.
1d
comment Using UUIDs for non-guessable URLs
Don't use non-cryptographic sources of "randomness" for things that shouldn't be guessable. Just use os.urandom and convert it to base64.
2d
comment Can a salt maintain pseudo-randomness after being modified?
There's no need to "derive" a random salt from your already-random salt. Just encode it directly as hex. That said, cryptographic hashes such as the ones offered by hashlib are unsuitable to use for passwords. Just use bcrypt.
Jun
25
comment RDRAND in Intel Celeron CPUs under Linux
Trust isn't a binary value of yes or no. Any number of components in your hardware or software could be working against you. The degree to which you trust the random bytes output by some software should be considered in relation to the likelihood of you being targeted and the sensitivity of the information you're trying to protect.
Jun
25
comment Lost in a field of Degrees and certifications
Certifications aren't worth much, and information security knowledge with no software (or hardware) engineering background is of limited use. If this is the field you want to get in, you're probably going to want to pursue a computer science or computer engineering degree of some sort (or gain equivalent knowledge through experience).
Jun
23
comment How easy is it to hide adding a file to a git repository
No, the design of git does not allow that as a possibility.
Jun
23
answered How easy is it to hide adding a file to a git repository
Jun
23
comment Is there a way to securely store unsalted passwords?
I'm confused what you mean by storing passwords with "two salts and three hashes". The defense that salting and hashing provides does not improve with naïve applications of "more" of them. It looks like you might be trying to invent your own password-hashing scheme. Please do not do this. Please just use scrypt, bcrypt, or PBKDF2.
Jun
18
comment How to identify hashes
Only if you are certain that the input is a hash; and then, the best you can do is take a guess based on length. A 256-bit input could be two MD5 hashes, SHA-256, SHA-512-256, BLAKE2b/256, CRC32, GOST, Skein, an HMAC of any of those, etc.
Jun
18
comment How to identify hashes
Then you simply cannot accomplish that which you are trying to do.
Jun
18
answered How to identify hashes
Jun
9
comment How secure is it to keep the salt with the password hash?
TL;DR, salts ensure that all passwords are globally unique to force an attacker to break each individually, thus preventing any reuse of work. They are not intended, expected, or required to be kept secret. That said, don't hash your own passwords; use something like bcrypt.
May
22
comment Can I use AES CTR mode to encrypt files with same key and nonce?
This is an incredibly dangerous thing to do, and the only discernible benefit is saving 32 bytes per file. I have to ask: Why?
May
18
comment Are there any security implications in creating an SSH key for the root user?
I suspect your basic premise is wrong. You do not need to sudo to the root user to accomplish this. Change the ownership and permissions on the subdirectory of /srv you're deploying these sites to, do the same for the directory where Apache configurations are stored in, and configure /etc/sudoers to allow this user to restart apache.
May
11
comment How are digital certificates compared?
If someone has the level of access on your computer necessary to overwrite your TLS certificate chain, you have already lost. They can almost certainly record your keystrokes, view and edit the entire contents of your hard drive, etc.
May
11
comment Which passwords to exclude from a password manager?
This sort of scenario is precisely why you should always have backups. That said, Google allows you to print out recovery codes that can be used in this type of event. Additionally, you can link your cell phone number (which you can use once you've acquired a new phone) to use to recover you account as well.
May
9
awarded  Nice Answer
May
8
answered Which passwords to exclude from a password manager?
May
5
comment Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?
Slow-hashes like bcrypt are designed to be tuned to meet your specific performance needs. If the default number of rounds is taking too long (minutes for 10 passwords is absurdly long), then simply reduce the work factor until you find a better balance.