423 reputation
214
bio website twitter.com/jonathanlgarber
location D.C. area, U.S.
age 26
visits member for 1 year, 10 months
seen 7 hours ago

I do research and design for a small engineering firm in Northern Virginia. I also enjoy expanding my amateur's knowledge of cryptography and security. I coach girls' volleyball with a club in Northern Virginia.


Jul
25
comment Can sites which check your password as you type pose a security risk?
Presumably you mean "pose a security risk apart from obviously not storing my password correctly"? Given a password of length n, checking any substring < n the way you're describing shouldn't be possible if the password is hashed, unless I'm simply missing something obvious through lack of coffee.
Mar
31
revised Can full disk encryption make malware recovery more difficult?
Edited to be more readable and slightly more in conformance with site standards.
Mar
31
comment Can full disk encryption make malware recovery more difficult?
Note that "malware removal" is a sub-optimal means of dealing with the problem. As painful as it may be, nuking from orbit is your only realistic option.
Mar
31
suggested suggested edit on Can full disk encryption make malware recovery more difficult?
Mar
25
comment Why should one not use SSL?
Nick Craver's blog post about transitioning to SSL on Stack Exchange gives an idea of how difficult that second point is. Thomas' first point is also addressed there.
Mar
15
revised Why is password strength often underestimated and uncertain in the context of password hashing?
Grammar/spelling cleanup; modified word choices to flow better; modified title
Mar
15
suggested suggested edit on Why is password strength often underestimated and uncertain in the context of password hashing?
Mar
9
comment Storing passwords in reversible form - a genuine use-case
If you're already going to break the rules once, by requesting that people hand third-party passwords over to you, how you break the rules becomes rather less relevant. Justifying it as "customer convenience" is no answer. In other words, don't store third-party credentials.
Mar
8
comment How is a “commonly used password” determined?
Password database breaches have occurred before. Commonly used ones are known due to this. (Plus, it should be fairly obvious that"password" and variants are common.)
Feb
25
comment Do you think it's a good policy to disclose your password encryption method to users?
Speaking for myself, I prefer seeing details, regardless of whether it may be less obscure or not. Sites with nebulous claims of "high-grade encryption" (or "military-grade encryption", blech) and "we meet industry standards" frustrate me because those claims are largely meaningless. (As a parallel example, Etsy (mostly) discloses exactly what tracking/analytics they use, with explanations of what each does. I prefer this to "we do this to make things better for you".)
Feb
11
comment Does (online) poker require cryptographically secure randomness?
I don't have access to Reddit right now, so I can't see the original context for the numbers, but can you double-check your number formatting in the third quote? It's a minor nitpick, but something like (219937 ** 4) - 1 would make more sense given the context. (Of course, if he actually did mean 879,744, that right there tells you all you need to know about whether someone is lying on the Internet. . .)
Jan
28
comment Is it safe to use the official Facebook apps in a public Wifi?
@KnightOfNi: In fairness to the OP, this specific question has NOT been "asked multiple times", ar at least the questions where it has are not publicly visible. I'm not entirely sure the question does belong here, but it's certainly not an easy-to-find duplicate. (I say this after a few minutes with the built-in SE search as well as some time with the Google.)
Jan
14
comment Is the concept of Authenticated Anonymity possible?
Nick P. on Bruce Schneier's blog recently linked to an interesting related paper. I can't pretend to understand the whole thing, but it is fascinating reading.
Jan
11
comment How does an encryption key work?
This is a reasonable high-level overview of symmetric encryption. You may wish to edit to include the fact that it ONLY addresses symmetric crypto, and that your statements of security assume correct implementation details. (No use of ECB, no re-use of IVs, etc.)
Dec
23
comment Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat?
There's a sort of canonical answer regarding rolling one's own.
Dec
19
comment How do I educate others about social engineering?
Some links appear to be missing. In the US-CERT section, the seventh bullet point (Install and Maintain...) is missing links. In "What should I do", the fourth bullet point (Watch for signs...) is missing a link to Preventing and Responding...
Dec
19
revised How do I educate others about social engineering?
Minor spelling/grammar cleanup; reworded a few sections to flow more cleanly; added missing words that had clearly been dropped unintentionally.
Dec
19
suggested suggested edit on How do I educate others about social engineering?
Nov
25
revised “Diffie-Hellman Key Exchange” in plain English
Spelling fixes; clarifications on a couple of minor points of the exchange
Nov
25
suggested suggested edit on “Diffie-Hellman Key Exchange” in plain English