486 reputation
49
bio website
location
age
visits member for 2 years, 8 months
seen yesterday

Jul
16
revised Is it good practice to send passwords in separate emails, and why?
Clarify title
Jul
16
suggested approved edit on Is it good practice to send passwords in separate emails, and why?
Jul
15
comment How to start writing crypto software
Funny story: I took a crypto class in college. We had to pick a crypto-related final project, so I decided to implement DES. True to character, I procrastinated until the last day. When it was due, I suddenly realized I didn't know how to use bitshift operators in JAVA. Rather than just looking it up (that would take TIME!), I implemented DES using the String class and actual strings of "1" and "0" characters. I parsed the incoming file into bytes, converting them to 8-character strings. When I presented my code to the class nobody called me out. Got an A, which helped cope with the shame.
Jul
6
comment How does malicious software encrypt victims' files?
I didn't mean confusion by you - I think your answer is excellent. :-) I meant confusion by the person who asked the question. It seems like they might be confused, if they're using hashing performance as a metric of encryption performance.
Jul
6
comment How does malicious software encrypt victims' files?
There's some confusion here too, where the OP is conflating encryption with hashing. Even though they share some similar mathematical theory, hashing IS NOT encryption, and the two serve very different purposes. Because of this, many hashing algorithms are slow BY DESIGN (to slow down brute-force attacks), whereas encryption algorithms tend to be streamlined as much as possible without compromising security.
May
13
comment Ensure that a file can only be decrypted after a specific date
@Pun: Okay, that makes sense. I was thinking the author would not give Twitter the key until he was ready for it to be released. Giving it to them ahead of time would indeed involve trust.
May
12
comment Ensure that a file can only be decrypted after a specific date
@AronFoster: I don't think Twitter qualifies as a "trusted authority" in this context. Either the key provided on their service works, or it doesn't. If for some reason they decide to lie about the key, then the message will "decrypt" to gibberish, and everyone knows what they did. (Well, that or the OP lied about providing a legitimate cyphertext.) If Twitter decides to not provide the key at all, than the author can publish via ANY other service. The channel here doesn't matter, since the requirement is not secrecy, but just distributing a key which works.
Apr
3
comment Is SiteKey a valid defense against Phishing?
Excellent analogy with "Simon Says," I'm going to reuse that! I'm a little confused how the successful MITM (stripping off HTTPS) relates to something like SiteKey. Once the attacker is in a successful MITM situation, aren't a whole host of other security measures defeated as well? In other words, if you're assuming a successful MITM anyway, couldn't you say that e.g. strong passwords are not effective? After all, if you have a MITM which has defeated SSL, all passwords will be plaintext to the attacker, right? Great answer though! I'm just trying to understand your point better.
Nov
28
awarded  Yearling
Sep
4
comment Where can I “hide” easter eggs for students learning about Linux security?
@Polynomial: Wow. Yes that's evil. I think that's beyond our current skillset at this point. Awesome though - thanks again!
Sep
4
comment Where can I “hide” easter eggs for students learning about Linux security?
Thanks so much!
Sep
4
asked Where can I “hide” easter eggs for students learning about Linux security?
Jul
24
comment Does a virus need to be clicked on to function?
Can you elaborate on disabling "Certain javascript"? I've heard of some people disabling js entirely for security purposes, but how do you do so selectively?
Nov
28
awarded  Yearling
Oct
15
comment Why are the first 16 bits of the message digest not encrypted in PGP?
I don't know anything about PGP, but is there a chance it's an initialization vector? If so, that's not supposed to be encrypted.
Sep
19
comment Is there any way to cryptographically hash a human thumbprint?
Haha, get it? "Indexing" key?
Sep
11
awarded  Commentator
Sep
11
comment Should I know my users passwords so I can check they can logon?
@Xander: at some point, you MUST trust your admins. That's why they're admins. They likely have direct access to databases anyway. I see your point, and you CAN mitigate some of this risk by maintaining audit records which those admins do NOT have access to modify. But if you have trust issues with people who directly access the databases, there are bigger problems than the possibility that they're twiddling with individual users' passwords.
Sep
9
comment Did US and UK spy agencies defeat privacy and security on the internet?
How would an implementation difference make them inoperable? I think what this.josh is implying is not that they produce different results, but perhaps one has an insecurity in the PROCESS, not in the RESULT.
Aug
30
comment Changing picture as characters entered into password
It's been my impression that these visual hashing schemes aren't intended to inform the user AS THEY TYPE, but AFTER they've FINISHED typing, such that they can know before they hit Enter whether they've messed up their password or not. I actually use Lotus at work for email, and I don't even look at the pattern while I type. But if I finish typing my password and I don't see a purple keychain, I know already that I have to start over (without having to hit Enter, get a "failure prompt, and THEN know that I messed up)