Reputation
3,282
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
10 21
Impact
~104k people reached

  • 0 posts edited
  • 33 helpful flags
  • 342 votes cast
Nov
27
awarded  Notable Question
Nov
18
comment Why does an overload of requests give one root access all of a sudden?
This isn't a saying. And it doesn't.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
Seems weird to me, @SteveSether. It's actually less effort to use a password manager, because you only have to hit a single hotkey to login. Not to mention, you have to remember whether or not it was a site that you used your "insecure" password for.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
If they're on your machine to hack it, you've already lost. If you're worried about someone hacking a copy uploaded to a cloud provider like Dropbox, iCloud, or Box, these file formats are published (example) and generally well-regarded by the cryptographic community. If someone finds a way to crack an arbitrary AES-256-CBC-encrypted, HMAC-SHA256-authenticated file at will, the world is going to have bigger problems than some passwords getting leaked. If you're that paranoid, keep it on your local machine and back up to local network storage.
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
What, exactly, do you expect to "fail"?
Nov
3
comment Is it a good idea to to use secure_hashing_function(mypassword.url) as my password?
@Ulkoma I don't know a single security professional at this point who doesn't use a password manager. Have a glance at what amateurs can learn from security pros. Numbers 2, 3, and 5 can all pretty much be squashed into one: just use a password manager.
Oct
30
comment What if TLS is suddenly found to have a critical defect?
I'm not at all assuming that. If there is truly some sort of trivially-exploitable TLS protocol bug, browser vendors and TLS implementors will work to find a resolution as quickly as possible. You've structured your question such that the only "real" answer you will seemingly accept is, "everyone runs around with their hair on fire while for two years while we wait to standardize TLS 1.3". If you assume such a response is patently ridiculous, then my answer is pretty much given. A fix or workaround will be found and distributed. Parties that can't update will remain vulnerable. Same as always.
Oct
30
answered What if TLS is suddenly found to have a critical defect?
Oct
29
comment Can using emojis make someone's password safer?
Not to have sour grapes, but it's generally considered good practice to withhold "accepting" an answer to a question for enough time to give multiple people a chance to provide answers. Accepting too early discourages additional answers.
Oct
29
revised Can using emojis make someone's password safer?
added 325 characters in body
Oct
29
comment Can using emojis make someone's password safer?
Yes, but I specifically mentioned lowercase letters in the example I gave. The entire point of my answer is that increasing the symbol count (e.g., 26 to 52) doesn't increase entropy as quickly as slightly increasing the length (e.g., 8 to 10).
Oct
29
revised Can using emojis make someone's password safer?
added 264 characters in body
Oct
29
revised Can using emojis make someone's password safer?
added 264 characters in body
Oct
29
answered Can using emojis make someone's password safer?
Oct
27
comment Is MD5 ok to use if salted?
Even if they stored a salted MD5, it would be garbage.
Oct
27
comment Is MD5 ok to use if salted?
Even salted MD5 is comically weak. Don't take advice on cryptography from non-cryptographers.
Oct
23
comment Password entry on OS X and keyloggers
You could just use a hardware 2FA device.
Oct
22
comment Why is U2F not good enough to be used as authentication?
If there's malware on your computer, you're screwed anyway. Wait for you to log in via U2F, steal your session cookie, profit.
Oct
22
answered Why is U2F not good enough to be used as authentication?
Oct
22
answered How safe would it be to store encrypted files on an unknown server?