16,638 reputation
12685
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 58 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


1d
answered How difficult it is to solve a salt if knowing the original data and the hash output that uses the SHA-2 algorithm
2d
comment Is it possible to use SSH agent for generic data encryption?
ssh-agent (in SSH1) was trained to automatically decrypt challenge messages presented by a potentially hostile server and send the hashes back over the internet. If it sent the original messages that would be a potential vulnerability. gpg-agent doesn't deal with networking directly; it decrypts/encrypts messages locally only with a key that's presumably only used to connect to SSH.
2d
awarded  Enlightened
2d
comment How to sign data with OpenSSL 0.9.8?
While not disagreeing, the 0.9.8 line of OpenSSL was last updated in Feb 2013 (0.9.8y), so some types of major vulnerabilities in OpenSSL were fixed (and 0.9.8 never had features like heartbeats), granted the 0.9.8 line never supported things like the latest version TLS 1.2.
2d
awarded  Nice Answer
Apr
17
comment How to prevent attacks before HSTS is established for the first time?
@KnightOfNi - And training users may not involve simply "sending an email" or making them take an online quiz. Training entails anything that can change the user's behavior. It could involve say serving http versions of pages that as soon as they select the password field to start typing a big warning pops up saying "THIS IS NOT AN HTTPS PAGE. NEVER TYPE A PASSWORD INTO AN HTTP PAGE. This was not a real attack, but attacks like this exist in the wild. (And then logs whatever username/IP address was used there)." Sort of similar to ismycreditcardstolen.com
Apr
17
revised How to prevent attacks before HSTS is established for the first time?
added 612 characters in body
Apr
17
comment How to prevent attacks before HSTS is established for the first time?
I'm not saying that training users will be reliable -- some users will find ways to ignore any sensible advice. But I am saying it is a sensible step in addition to others (like HSTS). At the very least it is a CYA practice and at best some rare user actually follows your advice and notices the URL is not colored with https and stops an attack.
Apr
17
awarded  Nice Answer
Apr
17
answered How to prevent attacks before HSTS is established for the first time?
Apr
17
revised Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself?
added 145 characters in body
Apr
17
revised Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself?
added 728 characters in body
Apr
17
revised Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself?
added 728 characters in body
Apr
17
answered Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself?
Apr
17
comment What's wrong with my own authentication scheme?
@immibis - I brought it up, assuming the username, password hashes, and possibly tokens are stored and checked a database of some sort and potentially a source of injection attack if done poorly.
Apr
16
comment What's wrong with my own authentication scheme?
@Rell3oT - It was not intended to be an exhaustive list, just a quick answer that the vague scheme is already attackable via CSRF. As an aside, listed a few more things that can be done wrong. Session management obviously depends on the application -- being logged into an unimportant account (say reddit as a normal user) doesn't need the same short-lived session requirements that a bank needs. And I did mention the two relevant cookie flags. Granted the number of flaws are innumerable; just gave a few. Others: token guessable, weak passwords allowed, weak pw reset mechanism, etc.
Apr
16
comment What's wrong with my own authentication scheme?
+1 @jimbob gives you a few (and the list is not exhaustive at all) -- Said list was not intended to be exhaustive. Started just describing the obvious CSRF vulnerability in the described part and then felt like adding a few other common things that popped to mind just in regard to authentication (ignoring things like XSS, LFI) as well as user access control, restricting access, secure generation random tokens, weak or reused passwords, don't log passwords in plaintext in server logs, etc
Apr
16
answered What's wrong with my own authentication scheme?
Apr
15
comment Is it possible to use SSH agent for generic data encryption?
@techtonik - I should add there are other agents; e.g., gpg-agent that act similarly to ssh-agent by keeping your passphrase protected encryption keys available for reuse (for a configurable amount of time), so you don't have to keep typing them long passphrases.
Apr
15
revised Is it possible to use SSH agent for generic data encryption?
added 48 characters in body