489 reputation
25
bio website
location Bristol, United Kingdom
age
visits member for 2 years, 6 months
seen yesterday

Feb
16
comment Which is more effective and 'secure': Compression+Encryption, or only Encryption?
CRIME/BREACH are active attacks: the attacker must be able to add things to the message before encrypting, then observe the ciphertext length. In this scenario, encryption alone is superior, but you've got much bigger problems if someone can tamper with your messages. Tiny summary of CRIME: you know someone's going to send either ORANGE or YELLOW. You stick ORANGE on the end so the message is either ORANGEORANGE which compresses to "2xORANGE" (8 characters) or YELLOWORANGE which does not compress (12 characters).
Feb
16
awarded  Editor
Feb
16
revised Which is more effective and 'secure': Compression+Encryption, or only Encryption?
added 1745 characters in body
Feb
16
comment Which is more effective and 'secure': Compression+Encryption, or only Encryption?
There are ciphers that I'd trust with or without compression and there are ciphers that I wouldn't trust in either case; gpg (with sensible algorithms and keylengths) falls into the former catergory. For the scenario of file encryption, if you're not worried about someone measuring the time it takes to decrypt/decompress files and using that to attack you, compression should really be irrelevant.
Feb
16
answered Which is more effective and 'secure': Compression+Encryption, or only Encryption?
Feb
16
answered What happens when encrypting with private key?
Nov
21
awarded  Yearling
Oct
31
comment Why use a Smartcard for (Two Factor) Auth instead of another medium?
For authentication, that's definitely correct. Since the OP mentioned bitlocker however I presume they're looking for a second factor to secure their decryption key, in which case the smart card will have to reveal its factor/key-share every time the OP asks to decrypt something.
Sep
14
awarded  Nice Answer
Sep
12
answered Is my custom password hashing algorithm insecure?
Apr
14
awarded  Nice Answer
Apr
11
awarded  Supporter
Apr
11
awarded  Yearling
Apr
10
comment How to explain Heartbleed without technical terms?
True that (and though I didn't mention it in the text, +1 reason to use perfect forward secrecy too). For the target audience mentioned in the original question, I'd need to think hard about how to explain mitm attacks in this context.
Apr
10
answered How to explain Heartbleed without technical terms?
Nov
21
awarded  Teacher
Nov
21
answered Why do we ask for a user's existing password when changing their password?