| bio | website | paul-ebermann.tumblr.com |
|---|---|---|
| location | Berlin, Germany | |
| age | ||
| visits | member for | 2 years, 3 months |
| seen | May 17 at 22:34 | |
| stats | profile views | 105 |
Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.
I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.
My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.
The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.
My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.
Some more links:
- I created an github repository where I'll add interesting code created for responses here.
- I lastly created Javadoc for JSch - i.e. I read most of the code, thus I now also can answer some JSch-related questions.
- I now have a blog, too. This will feature interesting questions and answers from Stackoverflow (beside other topics).
- A link to my google profile for testing this "author" feature.
- I got a Job with StackOverflow Careers, and my company's technology department (where I work) has now its own website/blog.
|
Apr 6 |
comment |
Is my developer's home-brew password security right or wrong, and why? @qarma HMAC is using the secret (i.e. the password) twice, this algorithm is using it only once. |
|
Apr 3 |
comment |
How quickly can these password schemes really be beaten? @StephenTouset Good point, I added some text relating this to the answer. Seems I missed this part of the question. |
|
Apr 3 |
revised |
How quickly can these password schemes really be beaten? expanded |
|
Apr 3 |
revised |
How quickly can these password schemes really be beaten? add some information from the comments. |
|
Apr 2 |
comment |
Password and Generated number - How does it work? I didn't downvote, but I suppose someone didn't like the "RTFM" attitude (which one might read from your answer). |
|
Apr 2 |
comment |
PINsentry PRNG and Bank Cards That device is just a keyboard + screen extension for your card, the calculations are happening in the card. |
|
Feb 12 |
awarded | Yearling |
|
Jan 27 |
comment |
XKCD #936: Short complex password, or long dictionary passphrase? For your password database, you should use a salt anyway, so rainbow tables are of no use. |
|
Jan 4 |
comment |
Shouldn't GPG key fetching use a secure connection? @humanityANDpeace In the case where there is no trusted path to (the key of) the sender of your message, you can't even trust that the message is really from this person. (The same is valid for encryption keys, with sender → receiver.) Anyone can upload a key with any name to the key server, and anyone else can express trust to this key, whether or not the connection is secured by TLS. The encrypted version of the protocol is there so nobody (other than the keyserver) knows which keys you request, I suppose. |
|
Dec 22 |
comment |
Is my developer's home-brew password security right or wrong, and why? I think the reason for the shuffling is to make the algorithm different from anything an attacker (who doesn't know the algorithm) expects. Using a application-specific secret salt input (aka "pepper") has this same effect and is more reliable. |
|
Nov 19 |
comment |
How is the available entropy in /dev/random calculated (or estimated)? I migrated your question here from cryptography Stack Exchange, because it seemed to be less about the cryptographic algorithms, and more about entropy collection. Please register your account here and on Crypto SE so you can gain possession of your question, comment and accept an answer. |
|
Nov 19 |
revised |
How is the available entropy in /dev/random calculated (or estimated)? edited tags |
|
Nov 4 |
comment |
What is SHA-3 and why did we change it? So you can use it when you have a hardware implementation in your server, I suppose. |
|
Oct 8 |
revised |
How to protect encryption key while application is using it edited tags |
|
Oct 7 |
revised |
Using Elliptic Curve Cryptography inline the diagram image |
|
Oct 7 |
suggested | suggested edit on Using Elliptic Curve Cryptography |
|
Sep 2 |
comment |
Is this login authentication safe? What is your goal? Do you want to let only people play who have a user account (i.e. a valid user name/password combination)? Also, how does the "login" relates to the rest of your session? |
|
Aug 14 |
awarded | Caucus |
|
Jun 29 |
comment |
How do I protect user data at rest? @DavidSchwartz The point is that (a) the data stored at the server (the "public key") is not sufficient to authenticate against this server, and (b) you don't transfer the password (or "minimum needed to authenticate") to the server, i.e. no "using plain text password everywhere else". Also, the "public key" is a kind of salted hash. |
|
Jun 29 |
comment |
How do I protect user data at rest? @DavidSchwartz: Have a look at the SRP protocol as an example on how to store a password in hashed form and still don't have to send it in plain over the wire for checking. |