Reputation
1,161
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 9
Newest
 Revival
Impact
~10k people reached

Apr
17
comment I anonymously submitted a security vulnerability, but it was not resolved. What now?
Any disclosure you do make, if you wish to remain anonymous, should be done from a public wifi and a burner email - never access that account from an internal network. Send a follow up with a time limit on when you intend to disclose the hole, then wait and disclose when ready. If you wish credit, create a hacker name for yourself and make sure they credit you when disclosed or use it when you out the security hole. Finding security holes has value, you might wish to have that credit one day.
Apr
12
comment Is knowing the salt a problem?
@dave_thompson_085, as OP was asking about rainbow tables for all possible salt/pwd combinations: the total possible space of salts is 2^160 (it does no good to be larger than the target hash length). Therefore, 2^50*2^160 or 2^(50+160). However, you did point me to an error - total space is 160*2^202 bytes, or about 2^1479 bytes of storage. Considerably smaller than 2^33600, but still many times larger than our universe.
Apr
5
comment Is knowing the salt a problem?
Still, I can't imagine enough of a reduction to matter from a practical perspective. Nevertheless, agreed it would impact the numbers.
Apr
5
comment Is knowing the salt a problem?
Fair enough. Worst case then. How much reduction can be expected with chaining?
Apr
5
answered Is knowing the salt a problem?
Jan
7
comment How does one securely create a MySQL database and user via the command line?
I was thinking you could also pipe in the SQL via echo "...$PW" | mysql ..., however, I wasn't clear on how to keep the password off of the command line in that case, because the echo would appear in a process list. Which, I think begs the question, how to create a file with a password from a shell script without data appearing on the command line? As I'm not sure about your computing environment, I don't have a recommendation for that without more details. However, a pipe (if on *nix OS) would work.
Jan
6
answered How does one securely create a MySQL database and user via the command line?
Dec
29
comment Evaluating the security of home security cameras
@AndréBorie, trying to balance between your points re: reduced attack surface and others' desire to simplify operations. Agreed that CLI w/ SSH (or VPN) is best. Somehow, router&dd-wrt feels simpler than RPI+linux. Also, router has the built in ports, so you get a pretty good WAN & ~4 LAN switch for a firmware upgrade. And, OP can always graduate to CLI from HTML when ready.
Dec
29
comment Evaluating the security of home security cameras
OP can use a router redeployed with dd-wrt, wifi off and run a VPN. No need for "linux management", it can be all web based mgmt on the router. (ignore the linux inside dd-wrt, please).
Dec
29
revised Evaluating the security of home security cameras
Added low budget suggestion to keep relevant to OP. Added headings for readability.
Dec
29
comment Evaluating the security of home security cameras
My apologies for violating the product endorsement policy. Comment here if I should re-write without them. Please take this as listing for comparison purposes and not a suggestion to buy the above equipment.
Dec
28
answered Evaluating the security of home security cameras
Dec
26
comment Triple DES Initialization Vector: Do I use 3 different IVs?
What's this for? Production code? Fun? Private use? Why do you want to do this?
Dec
17
awarded  Revival
Dec
12
comment facebook malicious notification 12.12.2015
Perhaps an update to the question for clarity.
Dec
12
comment facebook malicious notification 12.12.2015
This sounds like a standard email phishing attack. There's nothing exceptional about it that it uses Facebook, although it might be designed to take advantage of people who have FB accounts. It's not malware as that category of s/w infects computers and this is propagating via email.
Dec
12
comment Why don't despotic countries simply block all encrypted traffic?
Well done and with humor. Here's an answer explaining how this works. It even mentions how a government could do it once that government installed root cert is present.
Dec
8
comment Complex password rules - is there any sense?
@DmitryGrigoryev, that is a problem, in general. However, check out 2nd paragraph in that section. They point out that one could breakdown failed logins btwn previously successful IPs and new IPs. So, this only falls down when an ISP is using NAT for lots of users and an attacker resides within the same NAT'ed IP as the legitimate user.
Dec
8
comment Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?
@halfinformed, just to blow your mind, check out my answer to the question Complex password rules - is there any sense?. Actually, I don't think these two discussions are incompatible. When user IDs are well known, password complexity is vital (the only entropy). When user IDs are assigned and not public, password complexity is less important (entropy = UID+PWD). Check out Section 2 of the paper Do Strong Web Passwords Accomplish Anything?.
Dec
7
comment Generating shared secret key using existing receivers public key and senders private key
Are you looking to protect data in motion or data at rest? That is, SL Barth's answer protects data in motion, although it arrives in the clear. Do you want the message to be protected when stored and also have other characteristics of message protection like signatures, encryption and non-repudiation?