690 reputation
511
bio website blueraja.com/blog
location
age
visits member for 4 years, 5 months
seen 4 hours ago

Jul
16
comment Is it safe to send SSL certificates via email?
It's called the public key for a reason :)
Jul
13
awarded  Autobiographer
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@JasonCoyne: I challenge your claim that "a length of 8 [..] will have the password cracked very easily." Say the user uses only upper- and -lower-case letters, no numbers or special characters. And say your PBKDF2 is set up so the server takes 0.3s to hash one password. And say the attackers have a botnet 1000x more powerful than your server. Then it will still take an attacker over an expected 250 years to brute-force that one user's password. Since you are salting, that's 250 years per user.
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@JasonCoyne: 16 letters is way too high for the average user. Make it more reasonable (7-8 letters) and use bcrypt with an extremely high number of rounds, if you're that worried about it. That way the general security rests on your shoulders, and can be increased later if necessary without inconveniencing the user.
May
27
comment Can attackers get anything with DoS attacks except crashing the service?
If I am your competitor in <whatever business>, by bringing your servers down I am likely to gain some of your customers.
May
9
comment Are open wireless networks unencrypted?
@BrianGordon: The same way SSL does it? I realize Wifi AP's don't use signed keys, but OP doesn't know that, and it's feasible that they could.
Apr
23
comment The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?
According to this page, detecting a VM is not as trivial as you make it sound (that link comes from a comment in your SO link, with the claim that the techniques on that page don't work correctly).
Apr
18
comment Why do some bank websites use passwords that are not case sensitive?
Related: Are there any valid reasons for disallowing characters and limiting the length of passwords?
Apr
2
awarded  Nice Answer
Mar
25
awarded  Pundit
Feb
23
awarded  Yearling
Nov
24
comment “Diffie-Hellman Key Exchange” in plain English
I think it's worth mentioning that the reason this is secure is that, unlike normal log(x), the modular log(x) is thought to be hard to compute. Otherwise we could just do log_g(A) and log_g(B) to get a and b.
Sep
4
comment How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?
The same problem exists for all technologies - a better solution is usually available, but no one uses it because no one else uses it. And the solution tends to be the same too - either everyone agrees to a standard, or some big player in the field starts supporting it and convinces their customers it's what they want, at which points all their competitors will follow suit.
Sep
3
comment Why is password hashing considered so important?
@Andy actually newer hashes tend to be faster. SHA-3 was specifically chosen because it's so fast (well, and because it's so different from SHA-2..)
Jun
7
awarded  Citizen Patrol
Jun
7
comment What are the implications of NSA surveillance on the average internet user?
Also, the NSA is not the only department doing this; IANAL, but as I understand it, they used to require a warrant to listen in on phone conversations, but not anymore (please correct me if I'm wrong).
Jun
7
comment What are the implications of NSA surveillance on the average internet user?
"They can not however listen to your phone calls under this order" - Er, except they can and they are. This isn't anything new to anyone who follows security news, as it's been brought up in the media time-and-time again. See for example here or here or here or here.‌​..
Apr
4
comment Will encrypting the same file with GnuPG and the same key produce the same ciphertext?
@Stephen: Symmetric ciphers can get away with using a block-mode, because they typically have the luxury of being able to use a different key for every communication-session. In public-key crypto, where the key might need to be signed by a certificate authority, you don't. Note that since PGP uses a hybrid encryption (meaning the actual message is encrypted with a symmetric-algorithm, with a different key for every file/file-group), the message will be encrypted using a block-mode.
Apr
3
comment I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
-1 Why in the world would you think that companies that perform load-testing do so using illegal botnets?
Apr
1
comment What is zero day?
A zero-day is a vulnerability that is not known to the developers of the exploited software when it becomes public; an exploit becoming public does not make it no-longer a "zero-day," so that part of this answer is incorrect. This definition is actually the one given by the Wikipedia link ponsfonze linked to. However, exploits that exist but are not publically known are usually also referred to as zero-days, so that part of this answer is still correct.