22,916 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 5 hours ago

Mar
2
comment two encrypting / hashing case, which one is best
Right, unless I missed something the second example is just the second half of the first. The second part of it is fine as long as the iterations are high enough but the first call is just a waste of time.
Feb
27
comment Are there Ciphers designed to be slow?
Removed my other comments now that I understand where you are coming from. If you can update your answer to clarify you are talking about using encryption as a form of one way hash, then I will remove the downvote.
Feb
27
comment Are there Ciphers designed to be slow?
let us continue this discussion in chat
Feb
27
comment Are there Ciphers designed to be slow?
If you want to think about it another way, a key derivation function and a hash are basically the same thing (though a derivation doesn't necessarily have to be one way). Both are simply ways to make some other value from the input password and both are only as secure as the keyspace of the password being used for them.
Feb
27
comment Are there Ciphers designed to be slow?
@cbliard - as long as it is properly implemented to use a slow derivation function and a strong password is used, then protecting the random key with the derived key from the password would be just as resistent as a slow hash. You only need things to be slow when the keyspace is small enough to be exhaustible. Average usable passwords are exhaustible without adding artificial slowness to make them more resistant. That said, a single point of failure (one password revealing multiple keys) is another problem, but that's why security is about trade offs between risk and usability.
Feb
27
comment Are there Ciphers designed to be slow?
@cbliard - SSH is a communications protocol, not an encryption algorithm. I'm unsure what you are asking.
Feb
25
comment Displaying a video through the web whilst hiding the location
@JamieTaylor - There are actually secure stream servers available. They use a key handled by a trusted player, but require more complex clients, so they probably extend beyond being useful for you. I think there is DRM support in HTML5, but I don't know much about how it works in that particular context.
Feb
25
comment What is the current best practice to secure an executive's laptop?
Pray to whatever god you believe in....
Feb
21
comment Is 2FA really necessary with long, high entropy passwords?
@JosephL. if the server is compromised, then the system is already compromised and being able to impersonate a user doesn't really matter.
Feb
21
comment Is 2FA really necessary with long, high entropy passwords?
Depends on what your second factor is, it can be something you provide (like a fingerprint) but it can also be to provide evidence of something you have (like a one time key device that is actually proving you have a key).
Feb
21
comment Improving magnetic stripe card security with a “magnetic noise” hash?
I can't tell for certain, but I'd hazard a strong guess that read reliability and longevity drop like a rock. Old cards have trouble being read if they've taken any kind of abuse and I find it hard to believe that that wouldn't impact the read noise. It would also probably make it much harder to get a reliable read of the card because of the speed it would have to go through.
Feb
20
comment Why are salted hashes more secure?
@YolandaRuiz - tried to clean it up a bit
Feb
20
comment Make firewall management public?
How is it any different from a VPN connection though? You could use a different username and password for VPN than internal, but that doesn't really give any significant gain if you use a complex enough password that isn't used anywhere else, you could use a client side certificate for the VPN, but that could be done for web authentication too. Certainly, the best security is to not allow any remote access, VPN or otherwise, but if remote access is allowed at all, a properly secured (big if) web interface isn't a hugely larger attack surface.
Feb
20
comment What are the steps to take in order to securely transmit credit card information via a standard web form?
@Iszi - there are PCI-DSS standards that allow for storage of details that can be used for later processing, but the overhead for it is going to be immense and involve some ridiculous complexity at both the software and hardware level to maintain the required segmentation. You'd basically have to implement a one way dump into a segmented internal system and guarantee the data can't get back out. We had to work with a system like that for an offline payment processing thing that an insurance company I used to work for needed.
Feb
19
comment Is it safe to accept the security certificate from AOL chat?
There's no way for us to tell if this is any more valid than you can tell. You'd need to contact AOL out of band to find out if they changed it or not. You could also view the certificate and see if it appears to be from a reputable Certificate Authority.
Feb
19
comment Is it safe to accept the security certificate from AOL chat?
This question appears to be off-topic because it is about customer support for an application.
Feb
19
comment The best way to change my pgp key
@fauve - problem is, if I compromised your private key, I can send a revocation of the old key and say that you still have control of it. That said, there is just as much reason to trust that the signature of a new certificate is valid as there is to trust that the key actually hasn't been compromised any other time, but revocation would be a way to prevent you from being able to still use your key and limit it to my new one.
Feb
19
comment The best way to change my pgp key
That's true, they would possibly still want to validate it with you. It might not hurt to also talk to one of them that is well known and have them sign that the update is legit as well.
Feb
19
comment Why are PSTN lines not encrypted?
@zedman9991 - yes, my point was just that a party line (using one line for multiple parties) did not depend on the eavesdropping ability, but rather the eavesdropping ability simply wasn't worth addressing economically because it wasn't a concern (or even possible) at the time.
Feb
19
comment Legality of downloading leaked hashes / attempt cracking
@Adnan - basically, though it goes in to a little bit of a primer as to what the basis of the laws are. That's about as far as I think we can comfortably go here, but it is more information than the asker would otherwise have. I'd say the answer is more "it should be legal baring any unique local legislation, but such laws will probably start appearing soon if they haven't already"