Reputation
589
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 12
Newest
 Teacher
Impact
~8k people reached

Feb
4
comment Why are self signed certificates not trusted and is there a way to make them trusted?
@CristianTM: Often when someone "STFW" for an answer to a question, StackExchange is the top result - which is great and speaks highly of StackExchange! I don't think it's a legitimate reason to disqualify a question from being posted here. BadSkillz' answer below it simple, useful, and may drive this very page to the top of everyone's search results on the topic -- AND it took his as long to produce it as it took you to post your comment. :-)
Jan
26
comment Why did customer services say using symbols in a password is insecure?
They're savvy enough to care about SQL injection, but think the solution is to disallow certain characters in users' passwords? I smell a disconnect here, like a security officer somewhere knows just enough to be responsible for--but very careless with--a lot of users' data.
Jan
26
comment Why did customer services say using symbols in a password is insecure?
@iProgram: "To make sure they have better security in the future I did educate them and said that..." Call me cynical, but I doubt your comments were remembered for more than three seconds after the phone call ended. :-)
Jan
20
revised Is it possible to secretly monitor/backdoor hardware?
Removed unnecessary conversational bits, as well as assurance for the motivations behind the question
Jan
20
suggested approved edit on Is it possible to secretly monitor/backdoor hardware?
Nov
18
awarded  Teacher
Nov
17
answered Preventing registered users from sharing passwords
Nov
16
awarded  Popular Question
Oct
27
awarded  Nice Question
Sep
26
accepted Should I be worried if I accidentally entered my password in a username field?
Sep
26
comment Should I be worried if I accidentally entered my password in a username field?
@Rudy: True, but that observation is only useful for sites I have control over. 😉
Sep
25
asked Should I be worried if I accidentally entered my password in a username field?
Aug
28
comment How does a hacker know how many times a password was hashed?
Not really a direct answer, but ideal security architecture works even when the attacker has full access to all implementation details (including hashing round counts). So the assumption that the attacker knows how many rounds were used is not necessarily because it's common, but rather that it's always good to make WORST CASE assumptions when it comes to security.
Aug
11
comment How do session keys in public key cryptography work?
Yes, anyone in possession of Bob's private key would be able to decrypt the session key. However this isn't really a problem with the system, but rather an indication that Bob is misusing it. It is up to Bob to keep his "private" key private. If Bob goes around leaking his private key, he has no place getting mad that others can decrypt messages meant for him - that's just how it works!
Jul
16
revised Is it good practice to send passwords in separate emails, and why?
Clarify title
Jul
16
suggested approved edit on Is it good practice to send passwords in separate emails, and why?
Jul
15
comment How to start writing crypto software
Funny story: I took a crypto class in college. We had to pick a crypto-related final project, so I decided to implement DES. True to character, I procrastinated until the last day. When it was due, I suddenly realized I didn't know how to use bitshift operators in JAVA. Rather than just looking it up (that would take TIME!), I implemented DES using the String class and actual strings of "1" and "0" characters. I parsed the incoming file into bytes, converting them to 8-character strings. When I presented my code to the class nobody called me out. Got an A, which helped cope with the shame.
Jul
6
comment How does malicious software encrypt victims' files?
I didn't mean confusion by you - I think your answer is excellent. :-) I meant confusion by the person who asked the question. It seems like they might be confused, if they're using hashing performance as a metric of encryption performance.
Jul
6
comment How does malicious software encrypt victims' files?
There's some confusion here too, where the OP is conflating encryption with hashing. Even though they share some similar mathematical theory, hashing IS NOT encryption, and the two serve very different purposes. Because of this, many hashing algorithms are slow BY DESIGN (to slow down brute-force attacks), whereas encryption algorithms tend to be streamlined as much as possible without compromising security.
May
13
comment Ensure that a file can only be decrypted after a specific date
@Pun: Okay, that makes sense. I was thinking the author would not give Twitter the key until he was ready for it to be released. Giving it to them ahead of time would indeed involve trust.