Reputation
4,520
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 27
Newest
 Guru
Impact
~158k people reached

  • 0 posts edited
  • 13 helpful flags
  • 202 votes cast
May
27
revised Is this way of encoding cryptographic hashes safe?
added 23 characters in body
May
27
comment Is this way of encoding cryptographic hashes safe?
If this were a bijective transformation, this would be perfectly correct; unfortunately, it is not. Three hex digits can express 4096 values, while two base62 digits can only express 3906 values, which sometimes requires the scheme to use three base62 digits. If this scheme had used leading zeroes, it could work (but I suppose that would defeat the entire point, mapping 3 digits onto three digits). Note the three-digit 11p and 12m output groups in the question's example.
May
27
answered Is this way of encoding cryptographic hashes safe?
May
18
comment Signing (HMAC) cookie identifier
Just to give an example, suppose the server's token generator is just a counter. If you have token 17, you can be pretty sure 16 and 18 are valid tokens, too. If an attacker needs a MAC of that token, though, then knowing that 16 is a valid token doesn't help (because the token is really 16 and HMAC(16, secret_key)).
May
8
answered HTTPS - Can server see details of client side certificate?
Apr
27
comment Is browsing http sites insecure?
@Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script
Apr
22
comment Is this symetric or asymetric encryption?
Is your "plain text key" a fixed-length value? (i.e., can you type in whatever you like, like a passphrase, or is does it require an exact length like 256 bits?) If it's not fixed-length, then certainly your plaintext input is being transformed into a key somehow, either by a hash function or a key derivation function, and the "ciphertext" version you see is simply the one-way transformation of that passphrase.
Apr
22
comment Is this symetric or asymetric encryption?
"salts are used for asymmetric ciphers" -- salts are used for neither symmetric nor asymmetric ciphers; they are used for one-way transformations like hash functions.
Apr
18
awarded  Nice Answer
Apr
14
revised Possibility to sniff HTTPS traffic on devices without installing a certificate
deleted 18 characters in body
Apr
14
awarded  Guru
Apr
3
answered Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?
Apr
3
comment Is having the username and password fields on different pages more secure?
The only benefit I can think of is that it gives the user slightly longer to identify a phishing attack if the site is a fake duplicate. Closely related: Is SiteKey a valid defense against Phishing?
Apr
2
comment Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?
Where did you see the term "web bugs" used that caused confusion? The context in which you saw the phrase (or intend to use the phrase) may help to provide a good answer. "Web bugs" could mean a defect with some Web technology (a "bug" defect) or a tracking technique (e.g., you've been "bugged" by a tracking device).
Apr
2
comment Can all of Facebook's data be wiped out?
A good answer to this question would need to outline Facebook's approach to physical storage of their data (surely not a simple task and probably requires some degree of speculation), then address how to go about attacking that data storage from a variety of threat models (outside network attacker, physical infiltration, insider threat, nation state, etc.). I think this question is too broad, and needs to narrow down its assumptions about an organization's data storage (i.e., not necessarily Facebook but some organization whose storage looks like X) and narrow its threat model.
Apr
1
awarded  Custodian
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
Thanks, that's very helpful clarification. If you edit your question to include all that information (link to the paper, information you already understand, formality of the answer you're looking for), it will make it a lot easier for someone to provide a good answer to your question.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
It would also be helpful to edit your question to clarify how much you already understand about homomorphic encryption. Currently, it's not clear how much background information a good answer should give.
Mar
30
comment Difference between fully homomorphic and semi-homomorphic encryption
"We define the relaxed notion of a semi-homomorphic encryption scheme, where the plaintext can be recovered as long as the computed function does not increase the size of the input "too much"." Which part, specifically, of this definition gives you problems? The system has a homomorphism the allows a function over ciphertext, but the function will give faulty results if the output of the homomorphic function would be substantially greater than the input. Your question is not very specific. Is this the category of answer you are looking for, or do you need a more exact definition?