1,385 reputation
915
bio website michael.kjorling.se
location
age
visits member for 4 years, 1 month
seen 2 days ago

2d
comment Man in the middle attack theory
@moebius_eye Why would you be encrypting the public key with a strong passphrase? The public key is, almost by definition, meant to be widely distributed. The certificate is derived from the public key and thus also public; only the private key needs to be kept confidential.
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
Ah, the 1996 Secure Deletion of Data from Magnetic and Solid-State Memory paper by Peter Gutmann. Did you take the epilogues into account as well? Notice that "at the time the Usenix article was written MFM and RLL was the standard hard drive encoding technique for the installed technology base" and "emergence of PRML and EPRML drives was why ... the rules for the older drives didn't apply any more for the newer technology".
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
Your claim about combating "magnetic memory" would seem to go counter to the (cited) claims on Wikipedia (and in e.g. NIST 800-88) that with modern magnetic media, more than a single overwrite pass provides no additional protection against data recovery. Can you back up your claim with some sort of authoritative reference?
May
25
comment LUKS HDD Encryption crack
@Manumit If that was in response to my comment, I wasn't referring to the password trial throughput (X number of passwords per second) but rather how small a portion of the possible space (about 0.035%, assuming 62 possible characters and 6.5 unknown) needed to be searched before the password was found, let alone how small a portion of the total possible (given the password length and complexity) search space this was. This is something most people don't ever stop to consider; guessable passwords, or portions of passwords, make a massive dent in the difficulty in finding them.
May
24
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
8" 12MB HDD? That dates this to at least before 1980 or so, possibly earlier, and makes it comparable to the IBM 353 (2^21 64-bit words = 16 MiB).
May
24
comment LUKS HDD Encryption crack
When you get access to your data, make sure to set up proper, regular backups. Your data is still there, so at least in theory, you should be able to gain access to it, given time; but what if the problem had instead been a hard disk crash? Such things happen all the time.
May
24
comment LUKS HDD Encryption crack
150M passwords tried, out of something like 450bn possibilities? (Upper/lower case + digits, 13/2=6.5 characters unknown.) If anything, that shows how much can be gained in terms of brute-force speed if some information about the password is known.
May
23
revised Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
Better title
May
23
suggested approved edit on Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
May
23
answered Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
May
22
comment Server for School Coding Assignments
Have you considered using VMs to fully isolate the students from each other? Disk space, especially for relatively ephemeral data, is relatively cheap, and cloning a pre-provisioned VM can reduce the on-disk footprint, but 30+ VMs do need a reasonable chunk of RAM to work well.
May
22
suggested rejected edit on Server for School Coding Assignments
May
13
revised Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
Clarify based on discussion in comments
May
13
suggested approved edit on Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
May
13
comment Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
There is not necessarily anything wrong with simply stating that the only threat your application attempts to protect from is total break ciphertext-only attacks. For some use cases, that's sufficient. It's just good to be specific about what threat you are looking to protect against, so that we can properly evaluate your scheme.
May
13
comment Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
Full key-recovery (total break) ciphertext-only attacks only? (Key recovery leading to plaintext recovery.) There are many cryptanalytic attacks, and even more attacks against a whole cryptosystem (including random number generators and key derivation functions). What about data remanence? And so on. "Safe" is an overly broad term.
May
13
comment SMTP Header Injection
You can't infer that from what's written. All I can find on that page is that it says "For details of SMTP and ESMTP operation, consult RFC 821 (Simple Mail Transfer Protocol) and RFC 1869 (SMTP Service Extensions)." RFC 821 is horribly out of date as already stated (it was written back in 1982, for a very different Internet) and was obsoleted by RFC 2821 (in 2001, obsoleting also RFC 1869) which in turn was obsoleted by RFC 5321 (in 2008). RFC 5321 is the current standards track document describing SMTP.
May
13
comment Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
Safe against what? (What is your threat model?)
May
4
revised What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft
Better title
May
4
suggested approved edit on What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft