21,528 reputation
33699
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 7 months
seen yesterday
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Dec
17
awarded  tls
Dec
12
answered What is the safest way to ssh to a machine behind a router?
Nov
27
revised Can a form submission be encrypted even though address bar shows HTTP?
added 62 characters in body
Nov
26
answered Can a form submission be encrypted even though address bar shows HTTP?
Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - My mistake. I thought "or better" was responding to DigitalChris not to TomLeek. My bad.
Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - Disabling password entry in /etc/shadow is probably not desirable, as typically you may want the ability login to the machine via password when you are physically present (without requiring any of the standard tricks like booting into single user mode or mounting the hard drive from a live cd/usb and editing /etc/shadow ). You would also have to replace the password entry for every user to have the equivalent to PasswordAuthentication no.
Nov
18
awarded  Famous Question
Nov
14
comment Truly deniable encryption
What prevents the adversary from cloning the encrypted hard drive first before typing any passwords? (E.g., if a nuke password is given, just copy the clone again);
Nov
13
revised Are passwords stored in the cookie? encrypted?
added 121 characters in body
Nov
13
awarded  Nice Answer
Nov
13
answered Are passwords stored in the cookie? encrypted?
Nov
8
comment help identifying an IP address from email sent from my gmail account
The only IP address in there is 10.25.30.3 -- an internal IP address used by a google server. (IP address that start with 10. are used for private internal IP addresses ). Change your password and/or enable 2-factor authentication. Don't access your email on public computers that you do not control (and could be using a keyloggers to steal passwords).
Nov
3
comment SSL with GET and POST
@threeFourOneSixOneThree - It is possible for sites to strip sensitive information via javascript. However, by default (at least with all the browsers that I've tested), the referer header includes all HTTP GET query parameters. I've created a link on reddit to whatismyreferer.com (which echos the referer information that websites commonly log). Go to this link with GET parameters at the end like: reddit.com/r/sandboxtest/comments/2l7adf/referer_test/… and you will find the sensitive parts are part of the referer header (even with https).
Oct
30
comment Can anyone be hacked?
I don't agree that everything can be defended effectively from a targeted attack. Yes, you can defend against buffer overflows, SQL injection, etc type attacks. But if some gov't agency with nearly unlimited resources wants to get into your computers -- they can. They may have to bribe people to steal trusted certificates or make "honest" mistakes like heartbleed or just give you access, steal and alter your incoming packages to modify your hardware, break-in and covertly insert hardware keyloggers, threaten someone with access with imprisonment for non-compliance, etc.
Oct
20
awarded  Good Answer
Oct
17
comment Is the option to jump to blanks in password fields a security risk?
@CommuSoft - Agreed. Even if you do encrypt your hard drives, any attacker targeting you with physical access can surreptitiously insert a HW keylogger between your keyboard and computer to get your encryption passphrase.
Oct
17
awarded  Nice Answer
Oct
16
awarded  Nice Answer
Oct
16
comment Is the option to jump to blanks in password fields a security risk?
@stuXnet The flaw in that scenario is giving her any access to your computer while the password is typed in. A good password will have some ~60+ bits of entropy (to prevent the hash from being cracked offline); knowledge of a few spaces/special characters reduces it by maybe a dozen bits, but out of the realm of an online attack. If she can secretly find the spaces in the password field, she could say accidentally erase/alter it and force you to retype it (and gain more information by watching you type). Or she gets a confederate to come distract you for a second.
Oct
16
comment Is the option to jump to blanks in password fields a security risk?
@stuXnet - Can you think of a scenario where this could gain any info about the password via this attack, where you couldn't recover the complete password via javascript:var inputs=document.getElementsByTagName('input'); for( var i=0; i < inputs.length; i++ ) { if (inputs[i].getAttribute('type') === 'password') alert(inputs[i].value) }? As an analogy, having the last 4 digits of your credit card # on your receipt stored by a business isn't a security risk, as you just handed your full credit card (with your name, the full number, exp date, CVV, etc) to the person who swiped it.