Reputation
26,424
Next tag badge:
100/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

11h
comment Why is 128bit AES considered very strong but 160bit SHA depreciated?
@acidzombie24 - Yes, the security of accepting a particular hash function as part of a validly signing a certificate fundamentally relies on the infeasibility of collision attacks. There's no such thing as "nonsecure bits", it's just a 160 bit hash function takes roughly 2^80 effort to generate a collision to break. This is roughly comparable to the effort to brute-force a block cipher with an 80-bit key.
11h
comment Why is 128bit AES considered very strong but 160bit SHA depreciated?
@LieRyan - Totally agree. If you look at the edit history the whole idea was introduced by an edit that someone else approved. (Originally I wrote "If say p1 was a certificate for a domain you own and can verify ownership to a CA, you can get a CA to sign it" but was changed to "If say p1 happens to identify any free domain (like phpsdfpspfopo.tv) that you can buy any minute, then you can verify ownership of p1 to a CA and you can get a CA's signature of p1." Granted, changing the domain/subdomain seems a pretty simple way to explain changing p1 without going to fine details.
1d
revised Why is 128bit AES considered very strong but 160bit SHA depreciated?
Formatting exponents.
1d
revised Why is 128bit AES considered very strong but 160bit SHA depreciated?
Formatting exponents.
1d
revised Why is 128bit AES considered very strong but 160bit SHA depreciated?
added 121 characters in body
1d
revised Why is 128bit AES considered very strong but 160bit SHA depreciated?
The question asked about SSL certificates. Yes SSL certs use X.509 standard (and we use TLS these days), but it seems overly pedantic to call them that.
1d
awarded  Good Question
2d
revised Why is 128bit AES considered very strong but 160bit SHA depreciated?
added 1575 characters in body
2d
answered Why is 128bit AES considered very strong but 160bit SHA depreciated?
2d
revised What is the problem with multiple encryption and how do you know if you have decrypted a cipher?
added 4 characters in body
2d
comment What is the problem with multiple encryption and how do you know if you have decrypted a cipher?
If two 128-bit keys (K1, K2) are used to encrypt a message like c=E(K1, E(K2, m)) then to brute force c to recover m, you would need to check all the possible combinations of the two keys with a space of (2^128) * (2^128) = 2^(256) possibilities. This is equivalent to brute-forcing a 256-bit key. (Note you said (2^128)^128 which is equal to 2^(128*128) = 2^16384 -- this mistake was originally brought up in another answer by a user named Joe.)
Apr
26
comment Why aren't ransomware deployers arrested?
@Cestarian - The described doesn't seem foolproof solution against Ransomware. If you accidentally execute malware on any of your machines connected to the NAS and your machine has write privileges to the NAS, then you can be screwed. A good backup policy does (e.g., a privileged account does daily version controlled backups that no one else can write to).
Apr
24
answered What is the Javascript trying to do/exploit?
Apr
20
comment Does MAC address filtering provide security?
I don't see how MAC address filtering reduces the attack surface. OP is clearly asking about wifi (see the wifi tag + wlan0 in example) when the machines being filtered out are directly talking to the router with MAC address filtering. The biggest problem with MAC address filtering in this scenario, is it's easy to find the allowed MAC addresses (by just listening as they are in the unencrypted header of each packet) and it's also easy to change your MAC address. IP address filtering is different, as its not easy for non-network admins to change their IP to allowed ones (at least with TCP).
Apr
19
comment Security risks of using MongoDB ID vs a counter in URL?
Where in the OPs question did they specify if they are using HTTP? I see them leaving the protocol off of the URL.
Apr
19
answered Security risks of using MongoDB ID vs a counter in URL?
Apr
18
awarded  password-management
Apr
18
answered How can I mitigate the risk of my wifi key being shared with strangers through apps?
Apr
18
revised Security implications of reusing unused One-Time Password
Specified One-time-password to avoid confusion with One-Time Pad
Apr
16
comment I anonymously submitted a security vulnerability, but it was not resolved. What now?
Laws are vague and if you can demonstrate you've accessed information. E.g., one US federal law (18 U.S. Code § 1030) says if you obtain information from a protected computert (US gov't computer; used by financial institution; used in interstate/foreign commerce) that exceeds your authorized access its a crime. ( law.cornell.edu/uscode/text/18/1030 ).