1,417 reputation
915
bio website michael.kjorling.se
location
age
visits member for 4 years, 2 months
seen Jun 26 at 4:11

Jun
21
comment Does verifying identity by positions in passwords mean passwords are stored unhashed?
@Kevin I agree that most of Unicode would not be candidates for any given password, but my comment was meant to illustrate the best (for some definition of "best") case. The Unicode code space allows for a bit over 1M code points, hence that's the figure I used. The point was how much of a reduction of password security that is, not the exact number of possibilities to consider for each character position. It doesn't matter really even if the number of possible code points per character is 100x larger or smaller, because that still is only going to make a tiny dent in the conclusion.
Jun
20
comment Does verifying identity by positions in passwords mean passwords are stored unhashed?
Even if we are talking the full Unicode space (which we almost certainly aren't), that's still only just over 1M possible code points per character. Even if the password is then, say, a known 30 characters long, that brings the number of hash operations needed to break the password down from, say, a modest 62^30 to a good 1M×30. That's a reduction by 46 orders of magnitude. Even with an expensive hash, this turns an offline full recovery attack from completely infeasible to practically trivial for any determined attacker. A salt does not significantly raise the work factor in this case.
Jun
9
comment How can I know that developers will be ethical and not record my password in plaintext
@immibis TLS allows for client certificates to be provided to the server which can be used for authentication purposes, but generation is expensive (both in terms of time and entropy), they generally are a pain to move across devices, and the UI is normally inconsistent across implementations (and sometimes changes between versions). Barring website-imposed limitations like maximum password length (which there should be no need for if you do proper password hashing, for example) passwords can be made arbitrarily complex. TLS client certificates also present some practical problems in use.
May
30
comment What encryption is this?
This answer also pretty much says "whatever system this is from, throw it out and never look back". About the only thing that could be worse, I think, would be an unsalted MD5 hash.
May
29
revised Are consumer-grade routers any more or less vulnerable?
Clarify the title because "router" is potentially ambiguous while the question clearly talks about home/NAT type routers
May
29
suggested approved edit on Are consumer-grade routers any more or less vulnerable?
May
26
comment Man in the middle attack theory
@moebius_eye Why would you be encrypting the public key with a strong passphrase? The public key is, almost by definition, meant to be widely distributed. The certificate is derived from the public key and thus also public; only the private key needs to be kept confidential.
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
Ah, the 1996 Secure Deletion of Data from Magnetic and Solid-State Memory paper by Peter Gutmann. Did you take the epilogues into account as well? Notice that "at the time the Usenix article was written MFM and RLL was the standard hard drive encoding technique for the installed technology base" and "emergence of PRML and EPRML drives was why ... the rules for the older drives didn't apply any more for the newer technology".
May
25
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
Your claim about combating "magnetic memory" would seem to go counter to the (cited) claims on Wikipedia (and in e.g. NIST 800-88) that with modern magnetic media, more than a single overwrite pass provides no additional protection against data recovery. Can you back up your claim with some sort of authoritative reference?
May
25
comment LUKS HDD Encryption crack
@Manumit If that was in response to my comment, I wasn't referring to the password trial throughput (X number of passwords per second) but rather how small a portion of the possible space (about 0.035%, assuming 62 possible characters and 6.5 unknown) needed to be searched before the password was found, let alone how small a portion of the total possible (given the password length and complexity) search space this was. This is something most people don't ever stop to consider; guessable passwords, or portions of passwords, make a massive dent in the difficulty in finding them.
May
24
comment Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
8" 12MB HDD? That dates this to at least before 1980 or so, possibly earlier, and makes it comparable to the IBM 353 (2^21 64-bit words = 16 MiB).
May
24
comment LUKS HDD Encryption crack
When you get access to your data, make sure to set up proper, regular backups. Your data is still there, so at least in theory, you should be able to gain access to it, given time; but what if the problem had instead been a hard disk crash? Such things happen all the time.
May
24
comment LUKS HDD Encryption crack
150M passwords tried, out of something like 450bn possibilities? (Upper/lower case + digits, 13/2=6.5 characters unknown.) If anything, that shows how much can be gained in terms of brute-force speed if some information about the password is known.
May
23
revised Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
Better title
May
23
suggested approved edit on Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
May
23
answered Is there any way to determine the location of a laptop based on the MAC address or laptop serial number? (Lenovo)
May
22
comment Server for School Coding Assignments
Have you considered using VMs to fully isolate the students from each other? Disk space, especially for relatively ephemeral data, is relatively cheap, and cloning a pre-provisioned VM can reduce the on-disk footprint, but 30+ VMs do need a reasonable chunk of RAM to work well.
May
22
suggested rejected edit on Server for School Coding Assignments
May
13
revised Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?
Clarify based on discussion in comments
May
13
suggested approved edit on Would AES encryption of a small number of blocks be less secure than encrypting a large, fixed-size padded buffer?