meta user
network profile
| bio | website | |
|---|---|---|
| location | Brooklyn, NY | |
| age | 31 | |
| visits | member for | 2 years, 1 month |
| seen | 6 hours ago | |
| stats | profile views | 295 |
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.
Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.
Mostly program/script in python, django, and jquery these days doing mostly web apps.
Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.
Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).
|
Jun 15 |
answered | Are very short messages secure using Public Key Encryption? |
|
Jun 14 |
answered | Why are MD5 collisions dangerous? |
|
Jun 11 |
comment |
Is it legal to find bugs on a website and report them to the website's owner? +1 for the advice to cover your ass (don't search for security holes unless you have permission from the owner to audit). Laws are vague and the threat of legal action will complicate your life. But have "many people gotten jail time"? The wikipedia list of computer criminals is small (though likely incomplete), and none seem to fit the pattern of "I found a security hole and didn't use it". Most cases the sentence for virus creators/bot net owners/website defacers are relatively light (e.g., community service). |
|
Jun 10 |
comment |
Somebody bumped into me, next day my storage unit was burglarized @DanNeely - Agree RFID-blocking wallets are great. However, you should try testing the RFID wallet out. While I have found some that work; I've also seen one that only somewhat damped the RFID signal. (E.g., I could open my work door with the card in a closed wallet from ~6 inches away; instead of the three feet with it outside of the wallet. My newer (more expensive) RFID wallet won't work with my work ID from any distance when I tested (on one particular scanner). |
|
Jun 7 |
comment |
Where is my password stored on Linux? @Rox - Furthermore, the linux kernel being open-source is not relevant either. IIRC, the random salt is created from /dev/random, which uses true random bits are accumulated from measuring the noise properties of your system (e.g., did it take an even or odd number of clock cycles to access something from disk or time between keystrokes/mouse movements); so it is not predictable, even if it is open source. |
|
Jun 7 |
comment |
Where is my password stored on Linux? @Rox - First, salts work by being at high-probability a unique string that's concatenated to the password before its hashed. Therefore, someone can't attack millions of passwords in parallel; (e.g., generate sha256crypt's of a list of 100 million common passwords once and then compare against all million hashes you have until you find matches). Instead to attack just one hash with a unique salt, you'd have to try all the common passwords (concatenated with that unique salt) until one worked. Note the salt is stored with the hash, as to check a password you need to use the salt. |
|
Jun 6 |
comment |
Where is my password stored on Linux? It's important to note that while the crypt documentation refers to MD5, SHA256, SHA512 that they are not one application of the simple cryptographic hash function, but it uses en.wikipedia.org/wiki/Crypt_(C) which generally provide 1000 (MD5) to default of 5000 rounds of the cryptographic hash function. |
|
Jun 6 |
answered | Where is my password stored on Linux? |
|
Jun 5 |
awarded | Nice Answer |
|
Jun 3 |
comment |
How to stop/detect someone else registering a certificate for my domain @AJHenderson - Sorry that was confusing--I tried making two points. (1) While eavesdropping/altering HTTP/unencrypted data is straightforward to a local attacker (on your network/access your computer); I couldn't get you to go to an IP I control when you type the URL of sec.SE, even over HTTP with no crypto. A CA doing validation using unencrypted data over the internet is not trivial to attack; an average adversary can't MitM a CA doing a WHOIS query; most email uses TLS, etc. (2) Even so, crypto (DNSSEC, etc) could stop powerful adversaries (who in principle could do those attacks). |
|
Jun 2 |
comment |
How to stop/detect someone else registering a certificate for my domain @AJHenderson - Agree completely. My point was the (weak) verification of free certificates has holes that people who can alter HTTP traffic may also be able to attack (not that powerful adversaries wouldn't have other options). Personally, I couldn't force you to go to the wrong IP when you try looking at security.stackexchange.com (as I don't control computers/routers in the path from your computer to SEC.SE), but others can (e.g., on your/SEC.SE local network or control a router between you). Not to say its hopeless; there are solutions (e.g., DNSSEC, doing WHOIS over TLS, etc.) |
|
Jun 2 |
answered | How to stop/detect someone else registering a certificate for my domain |
|
May 23 |
awarded | Popular Question |
|
May 22 |
awarded | Yearling |
|
May 21 |
revised |
Is there a dictionary of visibly similar Unicode characters for Spam processing? deleted 22 characters in body |
|
May 21 |
revised |
Is there a dictionary of visibly similar Unicode characters for Spam processing? added 26 characters in body |
|
May 21 |
revised |
Is there a dictionary of visibly similar Unicode characters for Spam processing? added 705 characters in body |
|
May 21 |
answered | Is there a dictionary of visibly similar Unicode characters for Spam processing? |
|
May 20 |
answered | Is KeePass a good defense against keyloggers? |
|
May 19 |
awarded | Nice Answer |
