972 reputation
818
bio website
location
age
visits member for 3 years, 6 months
seen 18 hours ago

17h
comment Asymmetric crypto: Decrypt own messages without having private key
I find that ssh-keygen works pretty good -- setting up ssh private keys -- for generating keypair and saving the encrypted keypair in a standard place.
22h
comment Reusing Private/Public Keys
related: "What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?".
22h
comment What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?
related: "Reusing Private/Public Keys"
Sep
1
comment Applying file deltas to an encrypted file
related: Updating stored, encrypted containers on a server.
Sep
1
comment Updating stored, encrypted containers on a server
related: Applying file deltas to an encrypted file.
Sep
1
comment Is it possible to design a system where the client doesn't have to trust the server?
related: all the questions tagged "host-proof" over on the crypto stackexchange.
Aug
29
comment What is the point in having arbitrary username requirements?
related: security.stackexchange.com/questions/65503/… .
Aug
15
comment Difference between OS X md5 and gnu md5sum
+1. You might mention that this problem bites a lot of people: 1, 2, 3, etc.
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
related: "plus haters"
Feb
6
comment Sharing passwords through email can be considered insecure?
plaintextoffenders.com/about says "sending the password via email ... is bad." That seems to directly contradict "For most webs and services it is ok to send you a clear password ... to your e-mail." Did you maybe intend to put a "not" somewhere in that sentence?
Feb
6
comment Sharing passwords through email can be considered insecure?
Have you heard of plaintextoffenders.com/about ?
Feb
3
comment Does server RAM count as storage for PCI Compliance?
+1 agree. Maybe it would be better if the credit card data went directly from the customer to a PCI-compliant server directly to the payment processor (as with Stripe, Square, Chargify, etc.), rather than making a detour through some other server.
Jan
24
comment Where is the salt on the OpenSSL AES encryption?
related: "Is there a standard for OpenSSL-interoperable AES encryption?"
Jan
13
comment Increase the security of an already stored password hash
related: Convert old and busted password encryption to something sensible
Aug
5
comment Is using a public-key for logging in to SSH any better than saving a password?
If "not using a passphrase isn't smart", then why does the OpenSSL documentation specifically say that "it may be a good thing to avoid protecting it with a password" ? (Should I ask this as an independent question?)
May
13
comment how safe is the 256 bit encryption used in bank transactions
@GuySirton: While many people would be surprised if it turns out that factoring is NP-hard, is there any proof that factoring is definitely not NP-hard?
Dec
9
comment how to stop write downs
Is this a duplicate of Are there a standard method(s) for me to give someone else read-only access to my data?
Nov
22
comment iOS app - hash user password in-app or on-server?
@Polynomial: All websites that use "HTTPS" already somehow handle certificate distribution and management. Are you seriously saying that websites using "HTTPS" are nonstandard and too inconvenient for typical users?
Nov
19
comment Petraeus scandal - what would have been a better way to communicate electronically
Could you name or link to a few of these of secure setups?
Aug
27
comment Hash function change
@CodesInChaos: Are you thinking of Do I have to recompute all hashes if I change the work factor in bcrypt? ?