438 reputation
315
bio website twitter.com/jonathanlgarber
location D.C. area, U.S.
age 26
visits member for 2 years, 2 months
seen 2 days ago

I do research and design for a small engineering firm in Northern Virginia. I also enjoy expanding my amateur's knowledge of cryptography and security. I coach girls' volleyball with a club in Northern Virginia.


Jul
25
comment Can sites which check your password as you type pose a security risk?
Presumably you mean "pose a security risk apart from obviously not storing my password correctly"? Given a password of length n, checking any substring < n the way you're describing shouldn't be possible if the password is hashed, unless I'm simply missing something obvious through lack of coffee.
Mar
31
comment Can full disk encryption make malware recovery more difficult?
Note that "malware removal" is a sub-optimal means of dealing with the problem. As painful as it may be, nuking from orbit is your only realistic option.
Mar
25
comment Why should one not use SSL?
Nick Craver's blog post about transitioning to SSL on Stack Exchange gives an idea of how difficult that second point is. Thomas' first point is also addressed there.
Mar
9
comment Storing passwords in reversible form - a genuine use-case
If you're already going to break the rules once, by requesting that people hand third-party passwords over to you, how you break the rules becomes rather less relevant. Justifying it as "customer convenience" is no answer. In other words, don't store third-party credentials.
Mar
8
comment How is a “commonly used password” determined?
Password database breaches have occurred before. Commonly used ones are known due to this. (Plus, it should be fairly obvious that"password" and variants are common.)
Feb
25
comment Do you think it's a good policy to disclose your password encryption method to users?
Speaking for myself, I prefer seeing details, regardless of whether it may be less obscure or not. Sites with nebulous claims of "high-grade encryption" (or "military-grade encryption", blech) and "we meet industry standards" frustrate me because those claims are largely meaningless. (As a parallel example, Etsy (mostly) discloses exactly what tracking/analytics they use, with explanations of what each does. I prefer this to "we do this to make things better for you".)
Feb
11
comment Does (online) poker require cryptographically secure randomness?
I don't have access to Reddit right now, so I can't see the original context for the numbers, but can you double-check your number formatting in the third quote? It's a minor nitpick, but something like (219937 ** 4) - 1 would make more sense given the context. (Of course, if he actually did mean 879,744, that right there tells you all you need to know about whether someone is lying on the Internet. . .)
Jan
28
comment Is it safe to use the official Facebook apps in a public Wifi?
@KnightOfNi: In fairness to the OP, this specific question has NOT been "asked multiple times", ar at least the questions where it has are not publicly visible. I'm not entirely sure the question does belong here, but it's certainly not an easy-to-find duplicate. (I say this after a few minutes with the built-in SE search as well as some time with the Google.)
Jan
14
comment Is the concept of Authenticated Anonymity possible?
Nick P. on Bruce Schneier's blog recently linked to an interesting related paper. I can't pretend to understand the whole thing, but it is fascinating reading.
Jan
11
comment How does an encryption key work?
This is a reasonable high-level overview of symmetric encryption. You may wish to edit to include the fact that it ONLY addresses symmetric crypto, and that your statements of security assume correct implementation details. (No use of ECB, no re-use of IVs, etc.)
Dec
23
comment Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat?
There's a sort of canonical answer regarding rolling one's own.
Dec
19
comment How do I educate others about social engineering?
Some links appear to be missing. In the US-CERT section, the seventh bullet point (Install and Maintain...) is missing links. In "What should I do", the fourth bullet point (Watch for signs...) is missing a link to Preventing and Responding...
Oct
25
comment If the code to shuffle an array is known, is it possible for the randomized shuffle to stay secure?
Done. The reference to Kerckhoff isn't important in itself, but more to influence drive-by visitors. Given how vitally important the principle is in modern security, it can't hurt to have it prominently linked to everywhere.
Oct
25
comment If the code to shuffle an array is known, is it possible for the randomized shuffle to stay secure?
You may wish to mention Kerckhoffs' Principle explicitly in relation to your final paragraph.
Oct
11
comment Could SQRL really be as secure as they say?
@jpkrohling: So far as I understand it, password managers derive the key from the master password and then encrypt the vault using this key. It's not necessary to store the key, as it can (and should) be recomputed each time the vault is accessed. If you mean that the key is present in device memory (however temporary that may be), then yes, that's true, but it's kind of irrelevant.
Oct
11
comment Could SQRL really be as secure as they say?
@jpkrohling: With regard to password managers, I would guess that most users of such software do NOT store their master password on their mobile device, precisely because they are aware of how dangerous that is. I have one physical copy of my master password in a secure location, but no electronic copies. The attacks that would grant access to my master password are different from those that would compromise a site password, and are far less likely. (Primarily because attacking my password database would involve attacking me personally, rather than a large compromised site.)
Oct
11
comment Could SQRL really be as secure as they say?
"The caution already beaten in to the heads of users regarding password security does not necessarily translate to new authentication techniques like this one. . ." This is an excellent point, and the battle has already been lost to marketing. QR codes are seen as an easy way to get things done, not as a potential attack vector. Username/password pairs at least were FIRST used as an authentication mechanism, not a marketing tool.
Sep
22
comment Ethics question, post-publication of 'DIY hack' that implies security hack
This doesn't seem fundamentally different from any other open source code that may potentially have black hat applications. A tool is a tool; the intent of the user is what matters.
Sep
4
comment How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?
Right. I understand the academic attacks against new published solutions. The problem is, academic study almost never covers exactly the same ground as malicious attackers will. (Incentives being what they are.) Your last paragraph is pretty much what I'm getting at with this question.
Aug
21
comment Safe to email images with personal information? or use encryption for images?
Optical Character Recognition will only get better with time. An image file containing computer-generated (here used in the sense of "as opposed to hand-written") text is trivial to process with OCR techniques. Hand-written text is more difficult to process programmatically, but cannot by any means be considered to be secure.