Reputation
1,057
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 9 18
Impact
~29k people reached

Aug
11
comment Preventing Ethernet over power
I hear that 1:1 mains transformers, also called isolation transformers, are often used for medical devices that plug into mains power. It may be easier to find the kind of transformers travelers use to plug North American devices into 2:1 mains transformers plugged into European walls, and plug European devices into 1:2 mains transformers plugged into North American walls; plugging a 1:2 transformer into a 2:1 transformer creates a combined device that is effectively a net 1:1 transformer.
Aug
11
comment Practical steps for encrypting an encryption key for data stored in MySQL
@LukeTaylor: You are right. I was mis-applying the advice from "A Lesson In Timing Attacks (or, Don’t use MessageDigest.isEquals)". That essay says comparing hashes is vulnerable to a timing attack, but I'm pretty sure you are right that it doesn't apply to bcrypt-hashed passwords.
Aug
7
comment Advantages to alphanumeric-only usernames?
The answer to security.stackexchange.com/questions/10294/… seems to say that special characters are not necessary to make strong pass phrases. A seven word Diceware pass phrase is strong, even when it only uses the 26 lower case letters.
Jul
9
comment How can it be easy to write but “impossible” to extract the private key from a crypto token?
@DRF: Huh? If it were possible to back up the private key, wouldn't that defeat the entire purpose of a hardware crypto module?
Dec
21
comment Steganography to hide text within text
Related: "Any efficient text-based steganographic schemes?".
Oct
13
comment Is there a standard for printing a public key as a barcode?
related: "Putting my PGP ID/link on printed business cards".
Oct
13
comment Putting my PGP ID/link on printed business cards
related: "Is there a standard for printing a public key as a barcode?".
Sep
23
comment Asymmetric crypto: Decrypt own messages without having private key
I find that ssh-keygen works pretty good -- setting up ssh private keys -- for generating keypair and saving the encrypted keypair in a standard place.
Sep
22
comment Reusing Private/Public Keys
related: "What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?".
Sep
22
comment What is the best practice: separate ssh-key per host and user VS one ssh-key for all hosts?
related: "Reusing Private/Public Keys"
Sep
1
comment Applying file deltas to an encrypted file
related: Updating stored, encrypted containers on a server.
Sep
1
comment Updating stored, encrypted containers on a server
related: Applying file deltas to an encrypted file.
Sep
1
comment Is it possible to design a system where the client doesn't have to trust the server?
related: all the questions tagged "host-proof" over on the crypto stackexchange.
Aug
29
comment What is the point in having arbitrary username requirements?
related: security.stackexchange.com/questions/65503/… .
Aug
15
comment Difference between OS X md5 and gnu md5sum
+1. You might mention that this problem bites a lot of people: 1, 2, 3, etc.
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
related: "plus haters"
Feb
6
comment Sharing passwords through email can be considered insecure?
plaintextoffenders.com/about says "sending the password via email ... is bad." That seems to directly contradict "For most webs and services it is ok to send you a clear password ... to your e-mail." Did you maybe intend to put a "not" somewhere in that sentence?
Feb
6
comment Sharing passwords through email can be considered insecure?
Have you heard of plaintextoffenders.com/about ?
Feb
3
comment Does server RAM count as storage for PCI Compliance?
+1 agree. Maybe it would be better if the credit card data went directly from the customer to a PCI-compliant server directly to the payment processor (as with Stripe, Square, Chargify, etc.), rather than making a detour through some other server.
Jan
24
comment Where is the salt on the OpenSSL AES encryption?
related: "Is there a standard for OpenSSL-interoperable AES encryption?"