938 reputation
612
bio website michael.kjorling.se
location
age
visits member for 3 years, 7 months
seen Nov 19 at 13:50

Nov
19
revised How secure is GnuPG conventional encryption (with defaults)?
Better title
Nov
19
comment What are the benefits of encryption for everyday people?
In all honesty, #2 is much easier by just sending an email with a faked From: header. 99.9% of people won't even notice. SPF and friends work to partially mitigate this, but far from every recieving server acts on those.
Nov
19
suggested suggested edit on How secure is GnuPG conventional encryption (with defaults)?
Nov
12
comment Password Management within an Organisation
This looks like more or less what pass does.
Nov
11
awarded  Scholar
Nov
11
accepted Is publishing CRLs over HTTP a potential vulnerability?
Nov
8
revised Is publishing CRLs over HTTP a potential vulnerability?
added 64 characters in body
Nov
8
revised Is publishing CRLs over HTTP a potential vulnerability?
added 168 characters in body
Nov
8
asked Is publishing CRLs over HTTP a potential vulnerability?
Nov
7
comment Question about a simple strong password management system
That makes the password a part of the identifying key, which is the same thing in this case (especially since resource_name is likely to be known or at least guessable). I agree with @schroeder, you have bigger problems with your design.
Nov
6
comment Do we really need a long and complicated password for websites?
@R15 Only a hint of irony. The simple fact is that any mistake on part of a programmer in the wrong part of the code can lead to exploitable weaknesses, and it is far from certain that even with code review such mistakes are caught before someone manages to exploit them and it turns into a major issue. No malice on any developer's part required.
Nov
5
comment Do we really need a long and complicated password for websites?
You forgot "no programmer ever makes a mistake".
Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
@immibis That is true for now, but it doesn't have to be true. HTTP/2 untrusted certs could be used in different ways, for example to provide some degree of transmission security without implying any form of security to the user. Compare how compression can be used transparently.
Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
Note that for the purposes of the above comment, criminal MITMing on public networks is just about exactly the same thing as active surveillance.
Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
(2) is only semi-valid in a corporate setting or similar, where root certificates can be pushed out and used to successfully MITM any SSL/TLS session; few individuals do that sort of filtering. (3) doesn't apply, because even TLS with a self-signed certificate exchanged per session provides protection against blanket passive surveillance (I recall seeing some discussion about such TLS sessions showing up the same way as plaintext HTTP in browsers); you only need more than that when you need protection against active surveillance. (1) may be valid, depending on the approach taken.
Oct
31
comment Why use a Smartcard for (Two Factor) Auth instead of another medium?
"change it periodically based on your level of paranoia"; How does changing your password every 90 days increase security?
Oct
31
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
The best publicly known semi-practical attack against AES-256 appears to be a related-key attack with a complexity of about 2^99.5. The best known full key recovery attack again on AES-256 is 2^254.4 complexity. The former can probably be avoided in the key selection, and the latter is more of an academic curiosity than anything else, given that we can't even realistically count to a trivial 2^192 and are hard pressed for 2^128. Wikipedia: publicly known AES attacks.
Oct
31
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
This was a pretty good answer until the last two bullet points. Using untested algorithms in favor of well known, thoroughly examined ones that have been found to be quite secure in practice is a bad idea, for reasons that have been discussed over and over again. Edward Snowden was confident in using GnuPG to communicate securely, and has stated that "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.", with a strong caveat of endpoint security.
Oct
31
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
Possibly related: SuperUser: Encrypting a document with multiple keys, and making people accountable for those keys
Oct
25
comment Is using TrueCrypt in OSX secure?
Secure against what? (Note that the linked article is general, and not specific to the "activist or protester" category of people.)