4,583 reputation
1227
bio website apsillers.github.io
location United States
age 26
visits member for 2 years, 8 months
seen 54 mins ago

"The problem, when solved, will be simple."

  Conway's Game of Life
  Click any cell to toggle

  Controls:
  Step! Random Noise
  Clear New Pattern
  View source


54m
comment Is this way of encoding cryptographic hashes safe?
@Gilles An excellent point. I hope my edit does your comment justice?
55m
revised Is this way of encoding cryptographic hashes safe?
added 726 characters in body
16h
awarded  Nice Answer
18h
comment Is this way of encoding cryptographic hashes safe?
@Polynomial I'm not suggesting that the extra digit is dropped; I agree that it does remain, and that that causees a problem. If the groups 03f and f43 are adjacent in the input (11 and 111 in the output), it is not possible to use the five character 11111 in the output to determine which group came first in the input. To restate a much shorter version of my previous example, the output from 03ff43 and f4303f are indistinguishable.
18h
comment Is this way of encoding cryptographic hashes safe?
@Polynomial 03ff4303ff43...03ff439991 and f4303ff4303f...f4303f9991 both map to the same output value (1111111111...1111111CC1). There are lots of ways to modify the scheme so it doesn't cause collisions (I have suggested a few trivial ones), but as presented in the question, values can collide.
18h
revised Is this way of encoding cryptographic hashes safe?
added 23 characters in body
19h
comment Is this way of encoding cryptographic hashes safe?
If this were a bijective transformation, this would be perfectly correct; unfortunately, it is not. Three hex digits can express 4096 values, while two base62 digits can only express 3906 values, which sometimes requires the scheme to use three base62 digits. If this scheme had used leading zeroes, it could work (but I suppose that would defeat the entire point, mapping 3 digits onto three digits). Note the three-digit 11p and 12m output groups in the question's example.
19h
answered Is this way of encoding cryptographic hashes safe?
May
18
comment Signing (HMAC) cookie identifier
Just to give an example, suppose the server's token generator is just a counter. If you have token 17, you can be pretty sure 16 and 18 are valid tokens, too. If an attacker needs a MAC of that token, though, then knowing that 16 is a valid token doesn't help (because the token is really 16 and HMAC(16, secret_key)).
May
8
answered HTTPS - Can server see details of client side certificate?
Apr
27
comment Is browsing http sites insecure?
@Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script
Apr
22
comment Is this symetric or asymetric encryption?
Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase.
Apr
22
comment Is this symetric or asymetric encryption?
"salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions.
Apr
18
awarded  Nice Answer
Apr
14
revised Possibility to sniff HTTPS traffic on devices without installing a certificate
deleted 18 characters in body
Apr
14
awarded  Guru
Apr
3
answered Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?
Apr
3
comment Is having the username and password fields on different pages more secure?
The only benefit I can think of is that it gives the user slightly longer to identify a phishing attack if the site is a fake duplicate. Closely related: Is SiteKey a valid defense against Phishing?
Apr
2
comment Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?
Where did you see the term "web bugs" used that caused confusion? The context in which you saw the phrase (or intend to use the phrase) may help to provide a good answer. "Web bugs" could mean a defect with some Web technology (a "bug" defect) or a tracking technique (e.g., you've been "bugged" by a tracking device).