651 reputation
49
bio website blueraja.com/blog
location
age
visits member for 3 years, 10 months
seen 21 hours ago

Feb
23
awarded  Yearling
Nov
24
comment “Diffie-Hellman Key Exchange” in plain English
I think it's worth mentioning that the reason this is secure is that, unlike normal log(x), the modular log(x) is thought to be hard to compute. Otherwise we could just do log_g(A) and log_g(B) to get a and b.
Sep
4
comment How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?
The same problem exists for all technologies - a better solution is usually available, but no one uses it because no one else uses it. And the solution tends to be the same too - either everyone agrees to a standard, or some big player in the field starts supporting it and convinces their customers it's what they want, at which points all their competitors will follow suit.
Sep
3
comment Why is password hashing considered so important?
@Andy actually newer hashes tend to be faster. SHA-3 was specifically chosen because it's so fast (well, and because it's so different from SHA-2..)
Jun
7
awarded  Citizen Patrol
Jun
7
comment What are the implications of NSA surveillance on the average internet user?
Also, the NSA is not the only department doing this; IANAL, but as I understand it, they used to require a warrant to listen in on phone conversations, but not anymore (please correct me if I'm wrong).
Jun
7
comment What are the implications of NSA surveillance on the average internet user?
"They can not however listen to your phone calls under this order" - Er, except they can and they are. This isn't anything new to anyone who follows security news, as it's been brought up in the media time-and-time again. See for example here or here or here or here.‌​..
Apr
4
comment Will encrypting the same file with GPG and the same key produce the same ciphertext?
@Stephen: Symmetric ciphers can get away with using a block-mode, because they typically have the luxury of being able to use a different key for every communication-session. In public-key crypto, where the key might need to be signed by a certificate authority, you don't. Note that since PGP uses a hybrid encryption (meaning the actual message is encrypted with a symmetric-algorithm, with a different key for every file/file-group), the message will be encrypted using a block-mode.
Apr
3
comment I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
-1 Why in the world would you think that companies that perform load-testing do so using illegal botnets?
Apr
1
comment What is zero day?
A zero-day is a vulnerability that is not known to the developers of the exploited software when it becomes public; an exploit becoming public does not make it no-longer a "zero-day," so that part of this answer is incorrect. This definition is actually the one given by the Wikipedia link ponsfonze linked to. However, exploits that exist but are not publically known are usually also referred to as zero-days, so that part of this answer is still correct.
Mar
6
comment At what point does something count as 'security through obscurity'?
"Bruce Schneier showed that in order to brute force a 256-bit AES key you would need at a minimum, to capture the entire sun's energy output for 32 years(!)" - Actually, that was to brute-force (all combinations of) a 192-bit key. To brute force a 256-bit key would require more energy than the entire sun will ever output. In fact, he shows that it would require the energy of around 137 billion supernovas.
Mar
6
revised At what point does something count as 'security through obscurity'?
added 11 characters in body
Mar
6
answered At what point does something count as 'security through obscurity'?
Feb
27
awarded  Good Answer
Feb
23
awarded  Yearling
Feb
10
comment How to deal with a person who gets easily fooled by internet and mail scams?
I disagree with @tylerl, I think this is the correct answer. Educating the user is not the only preventative measure you should take, but it's definitively the most important - no matter how good your automated spam filters or antivirus are, some spam and viruses are bound to leak through, and it's up to the user to know not to give out their password to anyone, or not to run PornViewer.exe from a website. Especially for, as the question seems to be about, casual home-users (rather than business employees), where there's no real way to limit the damage they can do to themselves.
Feb
9
comment Does not having https moot this entire site?
Answers can be edited anyways, SSL or not. Same goes for Wikipedia. I'd be much more concerned about cookie-theft over non-SSL, allowing anyone at the same Starbucks to hijack your session. Highly related: meta.stackexchange.com/questions/69171
Feb
2
comment Malware infections from visiting or using YouTube
Also highly related
Feb
1
comment Malware infections from visiting or using YouTube
Note that Google hosts an insane number of ads, and sometimes malicious ads slip by. It's happened several times in the past (see the links in the last paragraph)
Jan
2
comment What is this authentication method/approach called?
It's a bit scary that some of the worst security practices I've seen online come from banks...