975 reputation
311
bio website
location Oshkosh, WI
age 29
visits member for 2 years, 11 months
seen Apr 8 at 7:20
Software developer.

Apr
26
awarded  Yearling
Mar
20
comment Why do APIs use API Keys instead of Usernames?
@SinanTaifour to use a real world example, your bank account number is a API Key, the information does not need to be kept secret, in-fact it is written on every check you hand out, however you don't go posting your bank account number on every billboard you find. Your PIN to use to call in and do phone banking would be your API Secret, you never reveal that to anyone.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
Fair enough, good reason too.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
You can get a offline copy of your database and a javascript app that can decrypt the database. Also the encryption is all done client side so the server is only storing binary blobs without access to the symmetric key. (that's why their "forgot your password" page does not give you a new password (it can't!), it just tells you your password hint you recorded at signup)
Jan
5
answered How to test security of an encryption algorithm?
Jan
4
comment Does Authenticode still work offline and with a “fake” certificate
If you forgo the time-stamp Autenticode will still work. However your end users will get a invalid signature error after the expiration date on the certificate. This is to prevent somone from stealing a old expired certificate from you, temporarily rolling back the clock on their computer, and signing a malicious exe with your old expired certificate.
Jan
4
comment Does Authenticode still work offline and with a “fake” certificate
Actually there is a online component but it is not required. If you want the authenticode signature to not give expiration warnings when the expiration date passes you must use a time-stamp server where the sigiture on the timestamp must also be signed by a trusted root (for simplicity most public CA's provide a time-stamp server and you can just have the same CA for your cert and the cert's time-stamp). See the Trusted Timestamping article on Wikipedia for more info.
Dec
13
comment Are there guidelines for application design of HIPAA compliant browser applications?
Ask a lawyer who is similar with HIPAA.
Dec
13
comment Is it possible to decrypt symmetric key encryption without the key?
Yes, without more information about how it was encrypted the fact of it being a key smaller than 64 bits is relatively useless.
Dec
12
comment Is it possible to decrypt symmetric key encryption without the key?
How do you know the key is "shorter than 64 bits" keys are normally a fixed size, are you referring to a pass phrase that is somewhere between 8 and 64 bits long that is turned in to a key?
Dec
12
comment Is there an asymmetric encryption algorithm that maintains the length of the plaintext?
Is there a reason for the asymmetric requirement? can you use a symmetric stream cipher and store the key asymmetrically in another location?
Dec
5
comment Given a large enough sampling of public keys could one begin to identify a private key?
That is incorrect, if you can find a cert that uses RSA for it's PKI and they share either P or Q you can trivially do the math and find the missing component by factoring the numbers together. However this is only a problem if you did not have enough entropy while generating P and Q. See this Blog post for more info
Dec
5
answered Given a large enough sampling of public keys could one begin to identify a private key?
Nov
26
comment Is Google spying on all of us?
@tekiegreg you can, here is the link to it. In fact there is a OptOut tab on that page that lets you disable it entirely.
Oct
31
comment How to login and encrypt data with the same password/key
@sudopeople A static salt can be used in conjunction with a dynamic salt, but it is known as Pepper
Oct
18
comment A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
One last change to not clutter the console, saves output to a sorted txt file.
Oct
18
revised A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
added 606 characters in body
Oct
18
comment A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
Actually I have a updated version. I updated my code. Call vigenere.JibberishKeys(); to get what you want.
Oct
18
revised A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
added 4353 characters in body
Oct
16
revised A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
Used a bigger wordlist and changed the code so it outputs in a semi sorted order based on S instead of K.