Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
2 5
~46k people reached

  • 0 posts edited
  • 0 helpful flags
  • 3 votes cast
comment Is using the username encrypted with the password as key a good password storage scheme?
Repeatable? I'm not sure I understand. I usually draw some bits from /dev/random and store them in a separate column next to their name; when someone logs in, use the name to look up their row and read out the salt. No need to regenerate it.
comment What security scheme is used by PDF password encryption, and why is it so weak?
The KDE pdf reader used to have a checkbox "obey DRM limitations" in its settings, which if nothing else is probably the best-named setting I've ever come across.
comment Which is more effective and 'secure': Compression+Encryption, or only Encryption?
CRIME/BREACH are active attacks: the attacker must be able to add things to the message before encrypting, then observe the ciphertext length. In this scenario, encryption alone is superior, but you've got much bigger problems if someone can tamper with your messages. Tiny summary of CRIME: you know someone's going to send either ORANGE or YELLOW. You stick ORANGE on the end so the message is either ORANGEORANGE which compresses to "2xORANGE" (8 characters) or YELLOWORANGE which does not compress (12 characters).
comment Which is more effective and 'secure': Compression+Encryption, or only Encryption?
There are ciphers that I'd trust with or without compression and there are ciphers that I wouldn't trust in either case; gpg (with sensible algorithms and keylengths) falls into the former catergory. For the scenario of file encryption, if you're not worried about someone measuring the time it takes to decrypt/decompress files and using that to attack you, compression should really be irrelevant.
comment Why use a Smartcard for (Two Factor) Auth instead of another medium?
For authentication, that's definitely correct. Since the OP mentioned bitlocker however I presume they're looking for a second factor to secure their decryption key, in which case the smart card will have to reveal its factor/key-share every time the OP asks to decrypt something.
comment How to explain Heartbleed without technical terms?
True that (and though I didn't mention it in the text, +1 reason to use perfect forward secrecy too). For the target audience mentioned in the original question, I'd need to think hard about how to explain mitm attacks in this context.