Reputation
26,434
Next tag badge:
100/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

Apr
15
awarded  Nice Answer
Apr
15
revised Does public wifi pose a security risk to existing logins?
added 883 characters in body
Apr
15
answered Does public wifi pose a security risk to existing logins?
Apr
11
revised Linux or Windows- the security issue
Trivial Capitalization Edits proposed earlier were done inconsistently.
Apr
11
revised Linux or Windows- the security issue
rolled back to a previous revision
Mar
26
revised If someone hacks my wi-fi password, what can they see and how?
added 209 characters in body
Mar
26
comment Is MAC address filtering effective on a wifi router?
@Cerveser - Your MAC address is not secret information -- it's necessary public info for wifi cards to identify packets intended for them. Every communication to any wifi router broadcasts the MAC to everyone with a wifi card in wifi radio range from you and this only needs to be eavesdropped once for just one device (e.g., wireless printer, smart TV, tablet, smart watch, internet camera, laptop, chromecast, smartphone). If by default wifi is off, then you are fine with or without MAC filtering -- there's no wifi to access as you turned it wifi off at the router.
Mar
23
answered number of ciphertext-plaintext pairs needed in double encryption
Mar
17
comment Could I use a TimeStamp also as IV?
For GCM (Galois Counter Mode) mode it's fine, for CBC a predictable IV (with substantial overlap with previous IVs) is insecure.
Mar
14
comment Why would an encrypted file be ~35% larger than an unencrypted one?
@warren This question is "Why would an encrypted file be 35% larger than an unencrypted one?" and the other is "why does <encryption command> increase the file size <almost perfectly by 35%>?" It doesn't matter if its different products using encryption (though owncloud calls openssl functions through PHP's openssl_encrypt), both boil down to "Why does this encryption increase file size by about 33.3-35.4%?" Because of base64 encoding the ciphertext. Lots of apps use base64 encoding after encryption, it would be silly to keep repeating the same question in every separate case.
Mar
14
comment How can I test a domain that I don't own for unencrypted communication vulnerabilities?
@Enigma - The login credentials at that site are POSTed in plaintext over HTTP.
Mar
13
awarded  Great Answer
Mar
12
awarded  Enlightened
Mar
12
awarded  Nice Answer
Mar
12
comment Why would an encrypted file be ~35% larger than an unencrypted one?
@IMSoP - While 0 and false have the same value, they have different semantic meanings. I understand options is now a bit mask and the LSB of options being 0 means base64 encode. I just think the design and documentation is poor. The documentation should state default behavior (b64 encode and PKCS#7 padding). You should never have to consult the language's source code to understand how the parameters of a built-in functions works. Maybe add a new constant OPENSSL_BASE64_PKCS7 (value 0) and document the difference between zero padding and PKCS7 padding. Also rename password to key.
Mar
11
comment Why would an encrypted file be ~35% larger than an unencrypted one?
@IMSoP When openssl is called from command line to encrypt with base64 encoding (-a flag), it inserts \n every 64 chars (see: openssl enc -aes-128-cbc -a -in file2encrypt). I expected a function named openssl_encrypt with flags set to base64 to act similarly. I don't have a problem maintaining backward compatibility, but the lack of documentation explaining the options=false means base64 encoded is a problem. The only documentation is options can be one of OPENSSL_RAW_DATA, OPENSSL_ZERO_PADDING which gives no indication of what happens when options=false unlike raw_output=false.
Mar
11
awarded  Guru
Mar
11
awarded  Good Answer
Mar
11
comment Why would an encrypted file be ~35% larger than an unencrypted one?
@MobyDisk - Maybe using binary files caused issues (e.g., used across firewalls that block random binary blobs)? Or just initially used as base64 is the default for PHP's openssl_encrypt/openssl_decrypt? There's a ticket to migrate to binary encryption from Sep 2014, though it's still open. Going to binary just requires switching false to true at L208 and L574 of crypt.php though backward compatibility makes it harder.
Mar
11
comment Why would an encrypted file be ~35% larger than an unencrypted one?
Playing around with openssl_encrypt in a PHP fiddle, it seems to base64 encode the data (and not insert linebreaks every 64 characters), but as php.net calls this an undocumented function, it wouldn't surprise me if this changed between PHP versions (if it's not 100% clear, I am not a PHP fan). Without the linebreaks, I'd expect encrypted files to be consistently 33.33% larger up to 1-3 blocks for padding, an IV, and a MAC. So saying 35% may just be rounding up for safety safe (and I shouldn't have assumed line breaks).