20,964 reputation
23698
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 5 months
seen 2 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Sep
30
awarded  Explainer
Sep
24
awarded  Autobiographer
Sep
19
comment Facebook drops SSL
@user10008 and @joozek - Facebook has a Strict-Transport-Security header for me when I am logged in. However, if I just run curl -I https://www.facebook.com, I do not see an HSTS header. According to this answer using transport layer security is a configurable option on facebook.
Sep
16
answered How session cookies work?
Sep
10
answered Opinions on my “Encryption at rest” implementation idea
Sep
5
awarded  Nice Answer
Sep
2
comment Why is security through obscurity not a good option for encryption?
@Evgeni Sergeev - That's a bad idea. If you just take an off the shelf RNG, there's a significant chance you'd using something like a 32-bit random number generator with a small period which would very much be attackable. See this question that states your method is easy to attack with elementary techniques. Even if you combined multiple linear congruential generators with large non-overlapping periods, in essence the parameters of the LCGs are the key - and probably come from a smaller key space and would still be quite vulnerable.
Sep
2
awarded  Nice Answer
Sep
2
revised Why is security through obscurity not a good option for encryption?
added 730 characters in body
Sep
2
answered Why is security through obscurity not a good option for encryption?
Aug
30
awarded  Notable Question
Aug
28
comment What is “c/s” in context of hash cracking?
I think we all agree on what's measured, but do you have a source for "crypts"? Seems equally likely that they intend c as an abbreviation for (hash) calculations per second. Crypts seems like the wrong terminology for hashing (unless its something like bcrypt where the hash is built from a cipher).
Aug
26
comment How does signing work with Elliptic Curve Crypto?
-1 for misinterpretation of equivalence of RSA / EC / symmetric key as needing a 512-bit EC key to encrypt a 256-bit symmetric key. (The equivalence is from the best known attacks; brute forcing an ~15000-bit RSA key with GNFS would take about 2^256 work as would brute-forcing a 256-bit symmetric key for an idealized symmetric cipher; you can easily encrypt a 256-bit symmetric key with a 1024-bit RSA key). Also as dave_thompson_085 pointed out, your answer doesn't really answer the questions or distinguish key exchange from signing.
Aug
26
comment Can anyone recognise this sudden influx of malformed HTTP requests?
Are these requests always from Windows User Agents? Your question and the stackoverflow question both only list windows user agents (from Chrome, Firefox, and IE11).
Aug
20
revised Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?
deleted 1 character in body
Aug
20
revised Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?
deleted 1 character in body
Aug
20
answered Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?
Aug
20
comment Can HMAC leak the password?
@Gilles - True. One obvious example of an easy to invert, non unique function (by not unique I mean not injective) is sin(x). If I ask you for to solve for x in c = sin(x), you can easily find all solutions x = {2n pi + sin^-1 (c), 2(n+1) pi - sin^-1 (c) } for integer n.
Aug
19
answered How to Conceal/Detect PGP Symmetric Algorithm Used
Aug
16
answered Where are passwords hashed?